{"id":"ghsa-ghsa-m5mm-p8h7-m29v","seq":661292,"kind":"advisory","title":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","url":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m5mm-p8h7-m29v","summary":"影響: npm:serialize-javascript < 7.1.3 → 7.1.3\nserialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // \"a\": { // \"f\": function f(){ return 1 }// // } Embedded in a","severity":"low","techs":["nodejs"],"cves":["CVE-2026-115897"],"tags":["GHSA-m5mm-p8h7-m29v","serialize-javascript"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:09:52.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}