CVE-2026-115754
LOW
2,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
Description
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70…
https://github.com/yahoo/serialize-javascript/pull/235
https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h…
https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xs…