Vulnerabilities in serialize-to-js 0.2.0