Live › vulnerability › CVE-2026-115754
Go to dashboardserialize-javascript versions 7.0.1 before 7.1.3 fail to escape the closing script tag inside serialized function source text. An attacker who controls a function's source through a spoofed toString() can break out of the HTML script element and inject live markup such as img onerror handlers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that serialize functions with serialize-javascript and embed the output inside HTML script elements are exposed, especially when an attacker can influence function source via a spoofed toString(). Projects that do not serialize functions, or that only serialize trusted static data, are unlikely to be exposed. Teams using the package only as a transitive build dependency should still check their lockfile.
No product ranges from the sources yet.
npm ls serialize-javascript to find installed versions in the dependency tree.7.0.1 up to but not including 7.1.3.7.1.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
This page as .md · .json · in your agent: get_signal("CVE-2026-115754")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.