CVE-2026-115754lowCWE-79

CVE-2026-115754: falha de baixa gravidade em yahoo serialize-javascript

serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

Publicada em

Seguir esta CVE+ Monitorar serialize-javascript+ Monitorar serialize-javascript

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.2%
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
yahoo · serialize-javascript
CVEs relacionadas — yahoo serialize-javascript

No mesmo produto, das mais perigosas para as menos.

CVE-2019-16769MEDIUMAffected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)EPSS 0.8%CVE-2026-34043MEDIUMSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsEPSS 0.5%CVE-2026-97711LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesEPSS 0.3%CVE-2026-115897LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyEPSS 0.3%