serialize-javascript XSS Flaw: Unescaped </script in Serialized Function Source (CVE-2026-115754, CVE-2026-115897)

What happened

Security advisories were published describing a cross-site scripting vulnerability in serialize-javascript, a library that serializes JavaScript values — including regular expressions and functions — to a superset of JSON. The vulnerability allows an attacker who can influence a function's source text (for example via a spoofed toString() method) to end that source text exactly at a bare closing script-tag prefix. Because each function body is escaped independently, a delimiter from surrounding serialized output can combine with this to close an HTML <script> element early. A subsequent serialized value can then supply injected markup, such as an img tag with an onerror handler, which becomes live, executable content on the page.

Technical cause

The root cause is in the function-source escaping logic used by serialize-javascript. The library does not neutralize a bare closing-script prefix (</script) when attacker-influenced function source text ends exactly at that prefix. Because function bodies are escaped independently of the surrounding serialized output, an attacker-controlled delimiter in nearby serialized data can combine with the unescaped prefix to terminate the enclosing script element prematurely, enabling injection of subsequent HTML content. This is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, 'Cross-site Scripting').

Why it matters

If an application serializes JavaScript function values using an affected version of serialize-javascript and embeds the result in an HTML page, and if any part of that function's source text can be influenced by an attacker (for instance through a spoofed toString() implementation on attacker-supplied data), the escaping failure could allow injected markup to execute in the context of the page. Both advisories score this as low severity: CVE-2026-115754 has a CVSS v4.0 base score of 2.3, and CVE-2026-115897 has a CVSS v4.0 base score of 2.1. Exploitation requires specific conditions, including attacker control over a function's source text and user interaction.

Who is affected

Applications using the npm package serialize-javascript in versions prior to 7.1.3 are affected, specifically where the application allows attacker-influenced data to reach a function value that is then serialized and embedded in HTML output. The exact introduced version differs slightly between the two advisories: one lists the affected range as starting from version 0 up to (not including) 7.1.3, while the other describes the issue as present from version 7.0.1 before 7.1.3. This discrepancy between the two advisory sources is noted but not resolved in the available facts.

Discovery and timeline

CVE-2026-115754 was published on 2026-10-23. CVE-2026-115897 (also tracked as GHSA-m5mm-p8h7-m29v) was published shortly afterward on the same day. No discoverer or reporting credit is included in the available fact package.

Affected versions

According to the GitHub Advisory Database and OSV.dev records, serialize-javascript versions from 0 up to (but not including) 7.1.3 are affected. One advisory description additionally narrows the starting point to version 7.0.1. Version 7.1.3 contains the fix.

Fixes and mitigation

The vendor has released serialize-javascript version 7.1.3, which fixes the escaping issue described in both advisories.

Recommended action

Update the serialize-javascript dependency to version 7.1.3 or later. Review any application code paths where attacker-influenced data could be serialized as a JavaScript function (for example via custom toString() implementations) and ensure such output is not embedded in HTML without additional safeguards.