CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

Q: What is CVE-2026-115754?

CVE-2026-115754 is a low-severity vulnerability in yahoo serialize-javascript, published on 23 Oct 2026.

Q: Is CVE-2026-115754 being exploited?

There is no known exploitation of CVE-2026-115754 in the wild and no public exploit code.

Low 2.3 Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-115754?

CVE-2026-115754 is a low-severity vulnerability in yahoo serialize-javascript, published on 23 Oct 2026.

Official description

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.

Weakness: CWE-79

Which versions are affected by CVE-2026-115754?

How do I fix CVE-2026-115754?

Upgrade to a fixed version.

Is CVE-2026-115754 being exploited?