CVE-2026-115897: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in yahoo serialize-javascript

The serialize-javascript library serializes JavaScript values to a JSON superset including functions and regexes. Before version 7.1.3, the escaping logic for function source code does not properly neutralize a closing </script> tag prefix if the attacker-controlled function source ends exactly at that prefix. Because each function body is escaped independently, a malicious delimiter from surrounding serialized output can prematurely close an HTML script element, allowing subsequent serialized values to inject live markup into the page. Exploitation requires control over the serialized function's source text, for example by spoofing the toString() method of a function. This vulnerability is fixed in version 7.1.3.

An attacker who can control the source text of a serialized function may inject malicious HTML or script code into web pages using serialize-javascript versions prior to 7.1.3. This can lead to cross-site scripting attacks, potentially allowing execution of arbitrary scripts in the context of the affected web application. The CVSS 4.0 score is low (2.1), reflecting the high attack complexity, partial user interaction, and limited scope of impact.

Upgrade serialize-javascript to version 7.1.3 or later, where the vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 7.1.3.