{"schema":"threatline.record/2","record":{"id":"CVE-2026-115754","aliases":["CVE-2026-115897","GHSA-m5mm-p8h7-m29v"],"summary":"serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body","details":"serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.","categories":["Libraries & packages"],"product":"serialize-javascript","vendor":"yahoo","ecosystem":"npm","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115754","source_modified_at":"2026-10-23T14:58:11.402Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"serialize-javascript","vendor":"yahoo","versions":[{"lessThan":"7.1.3","status":"affected","version":"7.0.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m5mm-p8h7-m29v","source_modified_at":"2026-10-23T22:30:04.106108556Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"npm","name":"serialize-javascript","purl":"pkg:npm/serialize-javascript"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.1.3"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115754","source_modified_at":"2026-10-23T14:58:11.402Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"serialize-javascript","ecosystem":null},"version":"7.1.3","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m5mm-p8h7-m29v","source_modified_at":"2026-10-23T22:30:04.106108556Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"npm","name":"serialize-javascript","purl":"pkg:npm/serialize-javascript"},"version":"7.1.3"}],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00322,"percentile":0.24067,"score_date":"2026-10-24"},"published_at":"2026-10-23T13:20:43.932Z","modified_at":"2026-10-23T22:30:04.106108556Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115754","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:58:11.402Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m5mm-p8h7-m29v","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T22:30:04.106108556Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115754","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/yahoo/serialize-javascript/pull/235","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","tags":["patch"]},{"source":"CVE List","url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T14:48:53.139109Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T22:30:04.106108556Z","content_hash":"9e15e52e2c19e5635108f818c04ec61bbe4f9423154d2d830075d4157895682c"}}