CVE-2026-115897: Cross-Site Scripting via Function Body Boundary Bypass in serialize-javascript

Vulnerability ID: CVE-2026-115897

CVSS Score: 2.1

Published: 2026-10-23

CVE-2026-115897 (also tracked as GHSA-m5mm-p8h7-m29v and aliased as CVE-2026-115754) is a Cross-Site Scripting (XSS) vulnerability in the Yahoo serialize-javascript npm package prior to version 7.1.3. The flaw exists in the regular expression used by escapeFunctionBody() to neutralize HTML script closing tags within serialized JavaScript functions. Because function bodies are sanitized in isolation before structural formatting is applied, a function whose string representation terminates directly with the sequence ' block and inject arbitrary HTML or JavaScript into the rendered document.

TL;DR

Versions of the serialize-javascript npm package prior to 7.1.3 fail to neutralize the bare string ' element.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type : Cross-Site Scripting (CWE-79)

Affected Component : serialize-javascript…