{"id":"CVE-2026-115754","kind":"vulnerability","aliases":["CVE-2026-115754"],"related":[],"title":"serialize-javascript: unescaped script close tag enables XSS via function source","description":"serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.","summary":"serialize-javascript versions 7.0.1 before 7.1.3 fail to escape the closing script tag inside serialized function source text. An attacker who controls a function's source through a spoofed toString() can break out of the HTML script element and inject live markup such as img onerror handlers.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","npm","package","server-rendering","webpack"],"not_affected_if":["no-function-serialization","static-data-only"],"how_to_check":"- Run `npm ls serialize-javascript` to find installed versions in the dependency tree.\n- Check whether any installed version is `7.0.1` up to but not including `7.1.3`.","fix":"- Upgrade serialize-javascript to `7.1.3` or later.\n- Rebuild and redeploy any bundle that embeds serialized output.","status":"open","published_at":"2026-10-23T14:17:52+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:34:49+00:00","updated_at":"2026-10-25T04:34:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:34:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade serialize-javascript to `7.1.3` or later.\n- Rebuild and redeploy any bundle that embeds serialized output.","reach":"internet","title":"serialize-javascript: unescaped script close tag enables XSS via function source","impact":"medium","summary":"serialize-javascript versions 7.0.1 before 7.1.3 fail to escape the closing script tag inside serialized function source text. An attacker who controls a function's source through a spoofed toString() can break out of the HTML script element and inject live markup such as img onerror handlers.","category":"package","nicknames":[],"who_cares":["npm","javascript","server-rendering","webpack"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker injects live markup and script into served HTML pages","analyst_note":"","how_to_check":"- Run `npm ls serialize-javascript` to find installed versions in the dependency tree.\n- Check whether any installed version is `7.0.1` up to but not including `7.1.3`.","needs_analyst":false,"not_affected_if":["no-function-serialization","static-data-only"],"who_is_affected":"Applications that serialize functions with serialize-javascript and embed the output inside HTML script elements are exposed, especially when an attacker can influence function source via a spoofed toString(). Projects that do not serialize functions, or that only serialize trusted static data, are unlikely to be exposed. Teams using the package only as a transitive build dependency should still check their lockfile.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3349,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115754':15A,18A '-2026':14A,17A '/script':107C '7.0.1':30B,78C '7.1.3':32B,80C 'allow':89C 'attack':46B,90C,108C 'break':58B,92C 'close':6A,37B 'combin':119C 'contain':81C 'control':48B,109C 'cross':84C 'cross-sit':83C 'cve':13A,16A 'delimit':122C 'element':64B,97C 'enabl':8A 'end':99C 'escap':35B 'fail':33B 'function':11A,42B,50B,101C,111C 'handler':73B,134C 'html':62B,95C 'img':71B,132C 'inject':66B,127C 'insid':40B 'javascript':3A,19B,28B,76C 'later':124C 'live':67B,128C 'markup':68B,129C 'npm':20B 'onerror':72B,133C 'output':121C 'packag':21B 'render':24B 'script':5A,38B,63B,86C,96C 'serial':2A,27B,41B,75C,100C 'serialize-javascript':1A,26B,74C 'server':23B 'server-rend':22B 'site':85C 'sourc':12A,43B,52B,102C,113C 'spoof':55B,116C 'surround':120C 'tag':7A,39B 'text':44B,103C 'tostr':56B,117C 'unescap':4A,106C 'valu':125C 'version':29B 'via':10A,114C 'vulner':87C 'webpack':25B 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"Applications that serialize functions with serialize-javascript and embed the output inside HTML script elements are exposed, especially when an attacker can influence function source via a spoofed toString(). Projects that do not serialize functions, or that only serialize trusted static data, are unlikely to be exposed. Teams using the package only as a transitive build dependency should still check their lockfile.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115754","severity":null,"published_at":"2026-10-23T14:17:52+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}