Vulnerabilities in serialize-to-js 0.5.0