CVE-2026-115754 — serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized functi…
Published: 2026-10-23 · CVSS: 2.3 · CVSS 4.0
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7