CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

• CWE-502

• http://packetstormsecurity.com/files/161356/Node.JS-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163222/Node.JS-Remote-Code-Execution.html
• http://www.securityfocus.com/bid/96225Third Party Advisory, VDB Entry
• https://nodesecurity.io/advisories/311Third Party Advisory
• https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/161356/Node.JS-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163222/Node.JS-Remote-Code-Execution.html
• http://www.securityfocus.com/bid/96225Third Party Advisory, VDB Entry
• https://nodesecurity.io/advisories/311Third Party Advisory
• https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/Exploit, Third Party Advisory

Published

Feb 9, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5933Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build…
• CVE-2017-5934Cross-site scripting (XSS) vulnerability in the link dialogu…
• CVE-2017-5936OpenStack Nova-LXD before 13.1.1 uses the wrong name for the…
• CVE-2017-5937The util_format_is_pure_uint function in vrend_renderer.c in…
• CVE-2017-5938Cross-site scripting (XSS) vulnerability in the nav_path fun…
• CVE-2017-5940Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 L…
• CVE-2017-5942An issue was discovered in the WP Mail plugin before 1.2 for…6.1
• CVE-2017-5943Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14,…
• CVE-2017-5944The dashboard subscription interface in Request Tracker (RT)…
• CVE-2017-5945An issue was discovered in the PoodLL Filter plugin through …
• CVE-2017-5946The Zip::File component in the rubyzip gem before 1.2.1 for …9.8
• CVE-2017-5947An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 d…6.8