CVE-2026-115754: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in yahoo serialize-javascript
Description
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
CVSS v4.0
Score 2.3low
Affected software
yahoo
serialize-javascript
pkg:github/serialize-javascriptRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The serialize-javascript package versions >=7.0.1 and <7.1.3 have an XSS vulnerability due to improper neutralization of input during web page generation. Attackers can exploit this by providing a function whose toString() output ends with an unescaped </script> tag, allowing them to break out of script elements and inject arbitrary HTML or JavaScript. This occurs because the serialization process does not properly escape the serialized function source text, enabling injection of live markup like img onerror handlers.
Potential Impact
Successful exploitation could allow an attacker to inject malicious scripts or markup into web pages that use the vulnerable serialize-javascript versions, potentially leading to client-side script execution. However, the CVSS score of 2.3 and the low severity rating indicate that the impact is limited, possibly due to required user interaction and attack complexity.
Mitigation Recommendations
A fix is available in serialize-javascript version 7.1.3 and later. Users should upgrade to version 7.1.3 or above to remediate this vulnerability. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-23T13:16:42.305Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb61954d27ba8daa2c43af
Added to database: 10/23/2026, 13:31:01 UTC
Last enriched: 10/23/2026, 13:46:00 UTC
Last updated: 10/23/2026, 15:26:05 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.