Vulnerabilities in serialize-to-js 1.2.2