CVE-2026-115897— Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Quick assessment
Affected
yahoo serialize-javascript
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Serialize.js 会将 JavaScript 值序列化为 JSON 的超集，其中包含正则表达式和函数。在 7.1.3 版本之前，函数源码的转义逻辑无法中和攻击者控制的函数源码在恰好以“裸”的 前缀结尾时的情形。由于每个函数体是独立进行转义的，周围序列化输出中提供的分隔符可能终止 HTML 的 元素，而后续序列化的值则可提供注入的标记，使其在页面中成为活跃元素。利用此漏洞需要能够控制被序列化函数的源码文本，例如通过伪造的 方法实现。该问题已在 7.1.3 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115897
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Source: CVE Program / CVE List V5
Vulnerability Description
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yahoo | serialize-javascript | < 7.1.3 | - |
|
II. Public POCs for CVE-2026-115897
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115897
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115897 (1)
Vendor Advisories for CVE-2026-115897 (1)
Vendor Pages for CVE-2026-115897 (1)
-
🔗 Release v7.1.3 · yahoo/serialize-javascript · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: serialize-javascript
-
CVE-2026-115754
serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </ -
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service vi -
CVE-2020-7660
serialize-javascript 代码问题漏洞 -
CVE-2019-16769
Affected versions of serialize-javascript are vulnerable to
Same vendor: yahoo
-
CVE-2026-115754
serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </ -
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-92778
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Route -
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing -
CVE-2026-57954
Elide 7.1.17 - Permission Bypass in Sort Expression Validati
Same weakness: CWE-79
-
CVE-2026-114194
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scriptin -
CVE-2026-115993
Stored XSS in the “Notes” field of project checklists -
CVE-2026-114695
WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scrip -
CVE-2026-114694
WordPress Events Manager plugin <= 7.4.8 - Cross Site Script -
CVE-2026-114693
WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross S
V. Comments for CVE-2026-115897
No comments yet