CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function…

published October 24, 2017

CVSS
—
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01148 · 66.4th percentile
Published
2017-10-24T20:00Z
EPSS history
Timeline
  • 24 OCT 20:00Z
    The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function…
    cvelistv5