PT-2026-102671 · Npm · Serialize-Javascript
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
serialize-javascript versions 7.1.1 through 7.1.1
Description
serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected against script-closing tags when the function source is influenced by an attacker. This occurs because the
SCRIPT CLOSE REGEXP can consume a second closing tag within a single match. If the serialized function is placed inside a script element, the remaining closing tag can terminate the element prematurely, causing the subsequent output to be interpreted as HTML and enabling cross-site scripting (XSS) within the page origin. Only function values are affected; ordinary data values and isJSON output are not impacted.Recommendations
Update serialize-javascript to version 7.1.2.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Serialize-Javascript