CVE-2026-115897
1 advisory.
npm/serialize-javascript CVE-2026-115897: low
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Action: Upgrade serialize-javascript to 7.1.3 or later.
npm i serialize-javascript@7.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.1.3 | - |
Fixed versions
| 7.1.3 |
Sources
- osv: GHSA-m5mm-p8h7-m29v
- https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
- https://github.com/yahoo/serialize-javascript/pull/235
- https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61
- https://github.com/yahoo/serialize-javascript
- https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3
CVE-2026-115897 · published · modified · JSON