Threat database

CVE-2026-115897 is a cross-site scripting (XSS) vulnerability in the yahoo serialize-javascript library prior to version 7.1.3. The issue arises because the function-source escaping logic fails to neutralize a bare closing-script prefix when attacker-controlled function source text ends exactly at that prefix. This can allow an attacker to inject live HTML elements into a page if they control the serialized function's source text, such as via a spoofed toString() method. The vulnerability has a low CVSS score of 2.1 and requires high attack complexity and partial user interaction. It is fixed in version 7.1.3.

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.

A cross-site scripting (XSS) vulnerability exists in the serialize-javascript library versions from 7.1.1 up to but not including 7.1.2. The issue arises when function values are serialized and embedded in script elements, allowing attacker-controlled script-closing tags to prematurely terminate the script and cause subsequent content to be interpreted as HTML, enabling XSS. Ordinary data values and JSON outputs are not affected. This vulnerability is fixed in version 7.1.2.

CMAK versions up to 3.0.0.6 have a protection mechanism failure where the scheduled leader election feature toggle is not applied to HTML form routes. This allows attackers with limited privileges to access form endpoints that control the recurring election scheduler, potentially disrupting leadership in managed Kafka clusters. The vulnerability has a medium severity score of 5.3 and does not have known exploits in the wild. No patch or official fix information is provided in the available data.

CVE-2026-92751 is a high-severity cross-site request forgery (CSRF) vulnerability in Yahoo CMAK versions up to 3.0.0.6. The software fails to implement a CSRF filter, allowing attackers to perform unauthorized state-changing actions on behalf of authenticated operators. Exploitation involves crafting hidden forms that submit destructive requests, such as topic deletion or cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or cookies without SameSite protection.

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

EPSS 0.6%Vulnerabilityyahoo#cwe-400#cwe-834United States+9