CVE-2026-115897: 
JavaScript vulnerability analysis and mitigation

CVE-2026-115897 is a Cross-Site Scripting (XSS) vulnerability in Yahoo's serialize-javascript npm package, caused by incomplete escaping of the </script prefix at the end of serialized function bodies. All versions prior to 7.1.3 are affected. The vulnerability was disclosed on October 23, 2026, with a fix released in version 7.1.3. It carries a CVSS v3.1 base score of 4.4 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the function-source escaping logic of serialize-javascript (Github Advisory). Because each function body is escaped independently, the library failed to neutralize a bare </script sequence when it appeared exactly at the end of a serialized function's source text — a condition that cannot arise with real JavaScript functions (which always end in }) but can be triggered via a spoofed toString() method. When the serialized output is embedded in an HTML <script> element, the injected </script prefix terminates the script block, and a subsequent serialized value can supply arbitrary HTML markup (e.g., <img onerror=...>) that becomes a live element in the page. The fix in PR #235 updated the SCRIPT_CLOSE_REGEXP to also match </script at the end of a string, ensuring it is unicode-escaped (GitHub PR #235, GitHub Commit).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on pages that embed serialized output, enabling session hijacking, credential theft, malware distribution, or unauthorized modification of page content (Github Advisory, Feedly). The confidentiality and integrity impacts are both rated Low, with no availability impact, reflecting the constrained exploitation conditions. The changed scope means the impact extends beyond the vulnerable component to the user's browser environment.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires the attacker to control the source text of a serialized function — in practice, through a spoofed toString() method — which is a non-trivial precondition that significantly limits the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Ordinary function values and non-function values are not affected by this flaw.

1. Identify a target application that uses serialize-javascript < 7.1.3 to serialize JavaScript objects (including functions) into HTML <script> blocks server-side.
2. Gain influence over a serialized function's source text — the primary vector is supplying an object with a spoofed toString() method that returns a crafted string ending in </script (e.g., f.toString = () => 'function f(){ return 1 }// </script').
3. Craft the payload: Ensure the spoofed toString() output ends exactly with the bare </script prefix, so the library's per-body escaping does not neutralize it. A subsequent serialized value in the same output provides the closing > and injected markup (e.g., <img src=x onerror=alert(1)>).
4. Trigger serialization: Cause the server to serialize the attacker-influenced object and embed the result in an HTML page's <script> block.
5. Victim visits the page: The browser parses the injected </script> as closing the script element, then renders the attacker-supplied HTML as a live DOM element, executing the injected JavaScript in the victim's browser context (Github Advisory, GitHub Commit).

• Logs: Server-side logs showing objects with unusual or externally-influenced toString() overrides being passed to serialize-javascript; application errors or unexpected output in serialized JavaScript blocks embedded in HTML responses.
• Network: HTTP responses containing </script sequences within <script> block content that are not properly unicode-escaped; unexpected <img>, <iframe>, or other HTML tags appearing after a <script> block in page source.
• File System: Unexpected modifications to server-side JavaScript files that introduce spoofed toString() methods on objects passed to serialization functions.
• Browser/Client: Client-side JavaScript errors or unexpected network requests (e.g., to attacker-controlled domains) originating from pages that embed server-side serialized JavaScript (Github Advisory).

Upgrade serialize-javascript to version 7.1.3 or later, which fixes the escaping logic to neutralize </script at the end of function bodies (GitHub Release v7.1.3). As a defense-in-depth measure, implement a strict Content Security Policy (CSP) to limit the impact of any injected scripts, and validate or restrict all sources of data passed to serialization functions to prevent untrusted input from reaching serialize-javascript. Avoid passing objects with externally-controlled toString() methods to the serializer.

The vulnerability was assigned and published via the GitHub Advisory Database (GHSA-m5mm-p8h7-m29v) and picked up by Red Hat's Bugzilla and security advisory feeds shortly after disclosure (Github Advisory, Red Hat Bugzilla). The issue was also noted on the InfoSec Exchange Mastodon instance and tracked by vulnerability aggregators including VulnDB, CVEFeed, and Tenable's cloud security plugins. Community reaction has been measured given the constrained exploitation preconditions, with no significant controversy or widespread alarm observed.