{"id":"CVE-2026-115897","title":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","summary":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-in…","severity":"low","cvss":2.1,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"yahoo","product":"serialize-javascript","affected":["serialize-javascript < 7.1.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T15:39:04.934773Z"},"published":"2026-10-23","updated":"2026-10-26","sourceUpdated":"2026-10-26T17:41:50.594Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115897","references":[{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","label":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"},{"url":"https://github.com/yahoo/serialize-javascript/pull/235","label":"https://github.com/yahoo/serialize-javascript/pull/235"},{"url":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","label":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61"},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","label":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115897.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115897"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560226"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115897"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897"},{"url":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v"}],"tags":["cve.org","csaf","vex","red-hat","ghsa","npm","score-dispute"],"epss":0.00307,"epssPercentile":0.23318,"aliases":["GHSA-m5mm-p8h7-m29v"],"ecosystem":"npm","patched":["serialize-javascript 7.1.3"],"scores":{"cna":2.1,"vendor":4.4},"ingestedAt":"2026-10-24T00:46:53.667Z","slug":"CVE-2026-115897","body":"## Overview\n\nSerialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.\n\n## Affected\n\n- `serialize-javascript < 7.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-115897)\n\nAffected packages:\n\n- `serialize-javascript < 7.1.3`\n\nPatched in:\n\n- `serialize-javascript 7.1.3`\n\nSource: https://github.com/advisories/GHSA-m5mm-p8h7-m29v\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115897.json)","depth":"sunlit","depthScore":12,"depthScoreParts":{"impact":11.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":229722,"id":"CVE-2026-115897","ts":1793039839823,"field":"cvss","old":"4.4","new":"2.1"},{"seq":229721,"id":"CVE-2026-115897","ts":1793039839823,"field":"severity","old":"medium","new":"low"},{"seq":228589,"id":"CVE-2026-115897","ts":1792844804714,"field":"cvss","old":"2.1","new":"4.4"},{"seq":228588,"id":"CVE-2026-115897","ts":1792844804714,"field":"severity","old":"low","new":"medium"}]}