Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

影響: npm:serialize-javascript < 7.1.3 → 7.1.3

serialize-javascript escapes its output so it is safe to embed inside a ). A body ending exactly at followed by markup: js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } Embedded in a

在 GitHub Advisory Database 阅读

2026/10/24 07:09，GitHub Advisory Database 发布了“Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。CVE：CVE-2026-115897。