CVE-2026-115897

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.1.3

Description The software fails to properly neutralize a bare closing-script prefix when the source text of a function ends exactly with that prefix. Because function bodies are escaped independently, a delimiter from the surrounding serialized output can terminate an HTML script element, allowing subsequent serialized values to inject markup that becomes a live element in the page. This occurs when an attacker controls the source text of a serialized function, typically achieved through a spoofed toString() function.

Recommendations Update to version 7.1.3. As a temporary workaround, avoid serializing function values whose source text or toString() can be influenced by an attacker.