The serialize-javascript package serializes JavaScript values to a JSON superset including functions and regular expressions. In versions >=7.1.1 and <7.1.2, function serialization is vulnerable because the regular expression SCRIPT_CLOSE_REGEXP can consume a second closing script tag inside one match. This causes the serialized function, when embedded in a script element, to terminate the script early and parse the remaining output as HTML, enabling cross-site scripting attacks. Only function values are affected; other data types and JSON outputs are safe. The issue is resolved in version 7.1.2.

An attacker able to influence function source code serialized by serialize-javascript in affected versions can inject script-closing tags that break out of the script context and execute arbitrary HTML/JavaScript in the page origin. This can lead to cross-site scripting attacks. However, the CVSS score is low (2.3), indicating limited impact or exploitability. Ordinary data serialization is not impacted.

Upgrade serialize-javascript to version 7.1.2 or later, where the vulnerability is fixed. No other mitigation is required as the issue only affects function serialization and is resolved in the official patch.