https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 15:58:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115897 <p>Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function&#39;s source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.</p> <p>Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function&#39;s source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115897 https://db.gcve.eu/vuln/ghsa-m5mm-p8h7-m29v <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>`serialize-javascript` escapes its output so it is safe to embed inside a `&lt;script&gt;` element. Before 7.1.3 that guarantee did not hold for a **function value whose source ends in a bare `&lt;/script`**.</p> <p>Each function body is escaped on its own, and a bare `&lt;/script` was only neutralized when followed — within the same body — by a character the HTML tokenizer treats as ending the tag name (TAB, LF, FF, CR, SPACE, `/` or `&gt;`). A body ending exactly at `&lt;/script` has no following character, so it was emitted unescaped. The delimiter is then supplied by the surrounding output (for example the newline the `space` option emits after the value), and a later serialized value can supply the closing `&gt;` followed by markup:</p> <p>```js const serialize = require(&#39;serialize-javascript&#39;); function f() {} f.toString = () =&gt; &#39;function f(){ return 1 }//&lt;/script&#39;; function g() {} g.toString = () =&gt; &#39;function g(x){ return x } &gt; &lt;img src=x onerror=alert(1)&gt;&#39;; serialize({ a: { f }, g }, { space: 2 }); // { // &#34;a&#34;: { // &#34;f&#34;: function f(){ return 1 }//&lt;/script // }, // &#34;g&#34;: function g(x){ return x } &gt; &lt;img src=x onerror=alert(1)&gt; // } ```</p> <p>Embedded in a `&lt;script&gt;` element, the script ends at the injected tag and the `&lt;img&gt;` becomes a live element in the page.</p> <p>Exploitation requires an attacker to control the **source text** of a serialized function, in practice through a spoofed `toString()`. Real functions always end in `}`, so ordinary function values are not affected, and non-fun…</p> <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>`serialize-javascript` escapes its output so it is safe to embed inside a `&lt;script&gt;` element. Before 7.1.3 that guarantee did not hold for a **function value whose source ends in a bare `&lt;/script`**.</p> <p>Each function body is escaped on its own, and a bare `&lt;/script` was only neutralized when followed — within the same body — by a character the HTML tokenizer treats as ending the tag name (TAB, LF, FF, CR, SPACE, `/` or `&gt;`). A body ending exactly at `&lt;/script` has no following character, so it was emitted unescaped. The delimiter is then supplied by the surrounding output (for example the newline the `space` option emits after the value), and a later serialized value can supply the closing `&gt;` followed by markup:</p> <p>```js const serialize = require(&#39;serialize-javascript&#39;); function f() {} f.toString = () =&gt; &#39;function f(){ return 1 }//&lt;/script&#39;; function g() {} g.toString = () =&gt; &#39;function g(x){ return x } &gt; &lt;img src=x onerror=alert(1)&gt;&#39;; serialize({ a: { f }, g }, { space: 2 }); // { // &#34;a&#34;: { // &#34;f&#34;: function f(){ return 1 }//&lt;/script // }, // &#34;g&#34;: function g(x){ return x } &gt; &lt;img src=x onerror=alert(1)&gt; // } ```</p> <p>Embedded in a `&lt;script&gt;` element, the script ends at the injected tag and the `&lt;img&gt;` becomes a live element in the page.</p> <p>Exploitation requires an attacker to control the **source text** of a serialized function, in practice through a spoofed `toString()`. Real functions always end in `}`, so ordinary function values are not affected, and non-fun…</p> https://db.gcve.eu/vuln/ghsa-m5mm-p8h7-m29v https://db.gcve.eu/vuln/msrc_cve-2026-115897 msrc_CVE-2026-115897 https://db.gcve.eu/vuln/msrc_cve-2026-115897