Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

影響: npm:serialize-javascript < 7.1.3 → 7.1.3

serialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } Embedded in a

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 07:09, GitHub Advisory Database에서 "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-115897.