## Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- CVE: CVE-2026-115897
- 公開日時: 2026-10-23T22:09:52.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m5mm-p8h7-m29v)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m5mm-p8h7-m29v

影響: npm:serialize-javascript < 7.1.3 → 7.1.3
serialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } Embedded in a