Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

影響: npm:serialize-javascript < 7.1.3 → 7.1.3

serialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } Embedded in a

GitHub Advisory Databaseで読む

2026/10/24 07:09、GitHub Advisory Databaseが「Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-115897。