@vue/cli-service uses serialize-javascript version 6.0.2 which is vulnerable

Version

5.0.9

Environment info

One of the @vue/cli-service dependencies serialize-javascript 6.0.2 has vulnerebbilities raised by dependabot alerts.

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.
The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Steps to reproduce

Enable dependabot alerts for the repository that uses @vue/cli-service latest version 5.0.9, once the repo is scanned, a high severity alert is raised Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

What is expected?

Have dependencies versions with no vulnerability

What is actually happening?

@vue/cli-service uses serialize-javascript version 6.0.2 which is vulnerable