CVE-2026-97711— Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Quick assessment
Affected
yahoo serialize-javascript
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97711
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Source: CVE Program / CVE List V5
Vulnerability Description
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yahoo | serialize-javascript | >= 7.1.1, < 7.1.2 | - |
|
II. Public POCs for CVE-2026-97711
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97711
请登录查看更多情报信息。
Other References for CVE-2026-97711 (3)
-
https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.2 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: yahoo
-
CVE-2026-92778
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Route -
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing -
CVE-2026-57954
Elide 7.1.17 - Permission Bypass in Sort Expression Validati -
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service vi -
CVE-2022-24827
SQL Injection in elide-datastore-aggregation
Same weakness: CWE-79
-
CVE-2026-90918
Joomla! Core - [20260908] - Core - XSS in HTML Mail Template -
CVE-2026-92225
Joomla! Core - [20260912] - Core - XSS in module list in Joo -
CVE-2026-92232
Joomla! Core - [20260916] - Core - XSS filter bypass in Inpu -
CVE-2026-90906
Joomla! Core - [20260901] - XSS in HTMLHelper::link method i -
CVE-2026-100238
Flow colon-separator and flow-guidedtour-optin-welcome-descr
V. Comments for CVE-2026-97711
No comments yet