CVE-2026-115897: Cross-Site Scripting via Function Body Boundary Bypass in serialize-javascript
Vulnerability ID: CVE-2026-115897
CVSS Score: 2.1
Published: 2026-10-23
CVE-2026-115897 (also tracked as GHSA-m5mm-p8h7-m29v and aliased as CVE-2026-115754) is a Cross-Site Scripting (XSS) vulnerability in the Yahoo serialize-javascript npm package prior to version 7.1.3. The flaw exists in the regular expression used by escapeFunctionBody() to neutralize HTML script closing tags within serialized JavaScript functions. Because function bodies are sanitized in isolation before structural formatting is applied, a function whose string representation terminates directly with the sequence ' block and inject arbitrary HTML or JavaScript into the rendered document.
TL;DR
Versions of the serialize-javascript npm package prior to 7.1.3 fail to neutralize the bare string ' element.
⚠️ Exploit Status: POC
Technical Details
- Vulnerability Type: Cross-Site Scripting (CWE-79)
- Affected Component: serialize-javascript (< 7.1.3) escapeFunctionBody()
- CVSS v4.0 Score: 2.1 Low (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)
- Attack Vector: Network (HTML breakout via serialized function boundary)</li> <li><strong>Exploit Status</strong>: Proof-of-Concept (Unit test fixtures available)</li> <li><strong>CISA KEV Status</strong>: Not Listed</li> <li><strong>Patched Version</strong>: 7.1.3</li> </ul> <h2> <a name="affected-systems" href="#affected-systems" class="anchor"> </a> Affected Systems </h2> <ul> <li>serialize-javascript (npm package)</li> <li><strong>serialize-javascript</strong>: < 7.1.3 (Fixed in: <code>7.1.3</code>)</li> </ul> <h2> <a name="code-analysis" href="#code-analysis" class="anchor"> </a> Code Analysis </h2> <h3> <a name="commit-2864b3c" href="#commit-2864b3c" class="anchor"> </a> Commit: <a href="https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61">2864b3c</a> </h3> <p>fix: escape '</script' at the end of a serialized function body (#235)<br> </p> <div class="highlight"><pre class="highlight diff"><code><span class="gh">diff --git a/index.js b/index.js </span><span class="gd">--- a/index.js </span><span class="gi">+++ b/index.js </span><span class="p">@@ -26,7 +26,11 @@</span> var UNSAFE_CHARS_REGEXP = /[<>\/\u2028\u2029]/g; // stays in script data, so only these need neutralizing. The bare-prefix form // matters because the matching `>` could be supplied by a different // serialized value later in the output, so escaping stops there without <span class="gd">-// waiting for a closing `>`. A trailing backslash is not a delimiter here </span><span class="gi">+// waiting for a closing `>`. For the same reason the bare form also matches +// at the very end of the string: each function body is escaped on its own, so +// a body ending in `</script` can't see the delimiter (e.g. the newline added +// by the `space` option) that the surrounding output supplies next +// (PSECBUGS-118415). A trailing backslash is not a delimiter here </span> // (that's a JS-level concern, not an HTML one), so this doesn't affect tagged // template literals like `String.raw`. // <span class="p">@@ -38,7 +42,7 @@</span> var UNSAFE_CHARS_REGEXP = /[<>\/\u2028\u2029]/g; // longer contain a second `<`, every `</script` in the source is either the // start of its own match or is followed by a non-delimiter — and the latter // the tokenizer never treats as an end tag. <span class="gd">-var SCRIPT_CLOSE_REGEXP = /<\/script[^<>]*>|<\/script(?=[\t\n\f\r \/>])/gi; </span><span class="gi">+var SCRIPT_CLOSE_REGEXP = /<\/script[^<>]*>|<\/script(?=$|[\t\n\f\r \/>])/gi; </span><span class="err"> </span> var RESERVED_SYMBOLS = ['*', 'async']; </code></pre></div> <p></p> <h2> <a name="mitigation-strategies" href="#mitigation-strategies" class="anchor"> </a> Mitigation Strategies </h2> <ul> <li>Upgrade serialize-javascript to version 7.1.3 or later across all direct and transitive dependencies.</li> <li>Disable function serialization by passing { ignoreFunction: true } to serialize() when function persistence is not required.</li> <li>Avoid using the 'space' formatting option when serializing objects destined for inline HTML <script> tags.</li> <li>Never construct JavaScript Function objects or allow custom .toString() overrides from untrusted user input.</li> <li>Deploy a strict Content Security Policy (CSP) that disallows unsafe inline event handlers and requires nonces or hashes for script execution.</li> </ul> <p><strong>Remediation Steps:</strong></p> <ol> <li>Run 'npm ls serialize-javascript' (or equivalent yarn/pnpm command) to identify all installed versions of serialize-javascript in the dependency tree.</li> <li>Update direct dependencies to 'serialize-javascript@^7.1.3' in package.json.</li> <li>If serialize-javascript is pulled in transitively, use the 'overrides' field in package.json (npm), 'resolutions' (Yarn), or 'pnpm.overrides' (pnpm) to force version '>=7.1.3'.</li> <li>Verify the resolved version in package-lock.json, yarn.lock, or pnpm-lock.yaml and redeploy the application.</li> </ol> <h2> <a name="references" href="#references" class="anchor"> </a> References </h2> <ul> <li><a href="https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v">GitHub Security Advisory GHSA-m5mm-p8h7-m29v</a></li> <li><a href="https://github.com/yahoo/serialize-javascript/pull/235">Pull Request #235: fix: escape '</script' at the end of a serialized function body</a></li> <li><a href="https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61">Patch Commit 2864b3c6260a3bfd52d2db3e70d1a079de108a61</a></li> <li><a href="https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3">serialize-javascript v7.1.3 Release Notes</a></li> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-115897">NVD - CVE-2026-115897</a></li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-115897">CVE.org Record - CVE-2026-115897</a></li> <li><a href="https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115897.json">CVE List V5 JSON Record - CVE-2026-115897</a></li> </ul> <hr> <p><em><a href="https://cvereports.com/reports/CVE-2026-115897">Read the full report for CVE-2026-115897 on our website</a> for more details including interactive diagrams and full exploit analysis.</em></p>
Top comments (0)