{"id":"CVE-2026-115754","summary":"serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped \u003c/script in function body","details":"serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped \u003c/script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.","aliases":["CVE-2026-115897","GHSA-m5mm-p8h7-m29v"],"modified":"2026-11-06T17:27:23.462997274Z","published":"2026-10-23T13:20:43.932Z","related":["openSUSE-SU-2026:12424-1"],"database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115754.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115754.json"},{"type":"ADVISORY","url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"},{"type":"ADVISORY","url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115754"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body"},{"type":"FIX","url":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61"},{"type":"FIX","url":"https://github.com/yahoo/serialize-javascript/pull/235"},{"type":"PACKAGE","url":"https://github.com/yahoo/serialize-javascript"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yahoo/serialize-javascript","events":[{"introduced":"f7fff15630a450dfcbcb88d33f7dc30b4f1e41f8"},{"fixed":"4d36b828f7c1c6a1f0de9ef932fefadcca0edace"},{"fixed":"2864b3c6260a3bfd52d2db3e70d1a079de108a61"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"7.0.1"},{"fixed":"7.1.3"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"2864b3c6260a3bfd52d2db3e70d1a079de108a61"}]},{"original_tag":"v7.1.3","range":[{"fixed":"4d36b828f7c1c6a1f0de9ef932fefadcca0edace"}],"source":"REFERENCES_TAG"}]}}],"versions":["v7.1.2","v7.1.1","v7.1.0","v7.0.7","v7.0.6","v7.0.5","v7.0.4","v7.0.3","v7.0.2","v7.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-115754.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}