Vulnerabilities in serialize-to-js 0.3.0