{"id":"CVE-2026-115754","title":"serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body","summary":"serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers control…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"yahoo","product":"serialize-javascript","affected":["serialize-javascript >= 7.0.1 < 7.1.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:48:53.139109Z"},"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T14:58:11.402Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115754","references":[{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","label":"GitHub Security Advisory (GHSA-m5mm-p8h7-m29v)"},{"url":"https://github.com/yahoo/serialize-javascript/pull/235"},{"url":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61"},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","label":"serialize-javascript v7.1.3 Release Notes"},{"url":"https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body","label":"VulnCheck Advisory: serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T14:28:08.714Z","slug":"CVE-2026-115754","body":"## Overview\n\nserialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.\n\n## Affected\n\n- `serialize-javascript >= 7.0.1 < 7.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}