CVE-2026-115754Medium· 4.7▾ SunlitA flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting (XSS) attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web pa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting (XSS) attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web page, the malicious payload can prematurely close the enclosing script element and execute arbitrary code in the context of the victim's browser session.
serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization — rated Moderate by Red Hat. Released 2026-10-23.
Affected:
No fix planned:
Not affected:
Affected
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-17033Medium· 6.8An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)
CVE-2026-115730Low· 3.1i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection (CVE-2026-115730)
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
CVE-2026-115350Medium· 6.1mistune: mistune: Cross-site scripting via Include directive (CVE-2026-115350)
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)