https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 09:10:25 +0000 https://db.gcve.eu/vuln/cve-2026-115897 <p><strong>Affected:</strong> yahoo serialize-javascript</p> <p>Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function&#39;s source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.</p> <p><strong>Affected:</strong> yahoo serialize-javascript</p> <p>Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function&#39;s source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.</p> https://db.gcve.eu/vuln/cve-2026-115897