Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

影響: npm:serialize-javascript < 7.1.3 → 7.1.3

serialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } Embedded in a

Read on GitHub Advisory Database

On 10/24/2026, 07:09 AM, GitHub Advisory Database published "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js. CVE: CVE-2026-115897.