{"id":"CVE-2026-115897","revision":null,"records":[{"revision":"f22be59cbbaf47d3b989409ac645a194","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-115754","aliases":[],"title":"serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body","description":"serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.","state":0,"publishedAt":"2026-10-23T13:20:43.932+00:00","modifiedAt":"2026-10-23T14:58:11.402+00:00","affected":[{"ecosystem":"Vendor product","name":"serialize-javascript","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"yahoo\",\n                    \"product\": \"serialize-javascript\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0.1\",\n                            \"lessThan\": \"7.1.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/serialize-javascript\",\n                    \"repo\": \"https://github.com/yahoo/serialize-javascript\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115754","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115754","identifiers":["CVE-2026-115754"]},"retained":false,"historicalAffected":[]},{"revision":"206e55780f7d48d18a08e2b56964547d","observedAt":"2026-10-23T22:48:20.692+00:00","statement":{"source":"cve-program","id":"CVE-2026-115897","aliases":[],"title":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","description":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.","state":0,"publishedAt":"2026-10-23T21:37:41.097+00:00","modifiedAt":"2026-10-23T21:37:41.097+00:00","affected":[{"ecosystem":"Vendor product","name":"serialize-javascript","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"yahoo\",\n                    \"product\": \"serialize-javascript\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.1,"severity":"LOW"}],"references":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115897","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115897","identifiers":["CVE-2026-115897"]},"retained":false,"historicalAffected":[]},{"revision":"0dc5ebc6f3d84b6eb46f04f60d64a3b0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-m5mm-p8h7-m29v","aliases":["CVE-2026-115754","CVE-2026-115897"],"title":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","description":"### Impact\n\n`serialize-javascript` escapes its output so it is safe to embed inside a\n`<script>` element. Before 7.1.3 that guarantee did not hold for a **function\nvalue whose source ends in a bare `</script`**.\n\nEach function body is escaped on its own, and a bare `</script` was only\nneutralized when followed — within the same body — by a character the HTML\ntokenizer treats as ending the tag name (TAB, LF, FF, CR, SPACE, `/` or `>`).\nA body ending exactly at `</script` has no following character, so it was\nemitted unescaped. The delimiter is then supplied by the surrounding output\n(for example the newline the `space` option emits after the value), and a\nlater serialized value can supply the closing `>` followed by markup:\n\n```js\nconst serialize = require('serialize-javascript');\nfunction f() {} f.toString = () => 'function f(){ return 1 }//</script';\nfunction g() {} g.toString = () => 'function g(x){ return x } > <img src=x onerror=alert(1)>';\nserialize({ a: { f }, g }, { space: 2 });\n// {\n//   \"a\": {\n//     \"f\": function f(){ return 1 }//</script\n//   },\n//   \"g\": function g(x){ return x } > <img src=x onerror=alert(1)>\n// }\n```\n\nEmbedded in a `<script>` element, the script ends at the injected tag and the\n`<img>` becomes a live element in the page.\n\nExploitation requires an attacker to control the **source text** of a\nserialized function, in practice through a spoofed `toString()`. Real\nfunctions always end in `}`, so ordinary function values are not affected,\nand non-function values (including strings containing `</script`) are\nescaped correctly.\n\n### Patches\n\nFixed in **7.1.3** (#235). The bare `</script` form is now also matched at\nthe end of the function body, so it is escaped regardless of what follows it\nin the output.\n\n### Workarounds\n\nUpgrade to **7.1.3**. If you cannot upgrade, do not serialize function values\nwhose source text (or `toString()`) can be influenced by an attacker.\n\n### Credits\n\nReported by **ha_kr25** via the Yahoo bug bounty program.","state":0,"publishedAt":"2026-10-23T22:09:52+00:00","modifiedAt":"2026-10-24T02:55:55.5077181+00:00","affected":[{"ecosystem":"npm","name":"serialize-javascript","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m5mm-p8h7-m29v","identifiers":["GHSA-m5mm-p8h7-m29v","CVE-2026-115754","CVE-2026-115897"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T16:17:13.5945497+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T16:17:13.5945497+00:00","lastSuccessAt":"2026-10-24T16:17:13.7819609+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.7819622+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-a9407c061ac75ced2d0a73c4e3748152394e8779db91b3a6e901673f00b86946","complete":true,"records":413905,"lastAttemptAt":"2026-10-24T16:17:13.1079997+00:00","lastSuccessAt":"2026-10-24T16:17:13.0175197+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.1079997+00:00","snapshotPublishedAt":"2026-10-24T15:24:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fe53955cf43042a8ba628b299bd6d3a7","complete":false,"records":1672,"lastAttemptAt":"2026-10-24T16:29:19.9413572+00:00","lastSuccessAt":"2026-10-24T16:29:19.928+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:29:19.928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1700,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T16:17:13.5945497+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T16:17:13.5945497+00:00","lastSuccessAt":"2026-10-24T16:17:13.7827946+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.7827949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cb8d4bef6e2747a9b59fe544580dd89c","complete":false,"records":1972,"lastAttemptAt":"2026-10-24T16:17:38.9368482+00:00","lastSuccessAt":"2026-10-24T16:17:38.932+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:38.932+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":2000,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-24T16:17:13.453426+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.453426+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T16:17:13.2532527+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.2532527+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-24T16:17:13.5544647+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.5544647+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-01c673643721642d348dd2cebd6ec154e69bb7cd20a86eeae91240dc3610a60f","complete":true,"records":230735,"lastAttemptAt":"2026-10-24T16:17:13.3536322+00:00","lastSuccessAt":"2026-10-24T13:19:32.2429544+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.3536322+00:00","snapshotPublishedAt":"2026-10-24T04:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}