Vulnerabilities in serialize-to-js 0.4.0