CVE-2026-115754

Name	CVE-2026-115754
Description	serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-serialize-javascript (PTS)	bookworm	6.0.0-2+deb12u1	vulnerable
	trixie	6.0.2-1	vulnerable
	sid, forky	7.1.2+~5.0.4-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-serialize-javascript	source	(unstable)	(unfixed)

Notes

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
https://github.com/yahoo/serialize-javascript/pull/235
Fixed by: https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 (v7.1.3)