Open
Description
Describe the bug
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to unsanitized URLs. An Attacker can introduce unsafe HTML characters through non-http URLs.
Versions
vue: 3
vue-apollo: upto 4.2.1
Additional context
`const serialize = require('serialize-javascript');
let x = serialize({
x: new URL("x:</script>")
});
console.log(x)`
Guess this got fixed in serialize-javascript 6.0.2
Metadata
Metadata
Assignees
Labels
No labels