CVE-2026-115754 in serialize-javascript
Summary
by MITRE • 10/23/2026
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in serialize-javascript versions prior to 7.1.3 represents a critical cross-site scripting flaw rooted in improper input sanitization during the serialization of JavaScript objects into string representations. This library is commonly used in web development environments, particularly within build tools and server-side rendering pipelines, to convert complex data structures into JSON-like strings or executable script content. The core technical failure occurs when the serializer processes function source code that has been manipulated through a spoofed toString method. In standard JavaScript execution contexts, functions are often serialized by extracting their source text via the toString() prototype. If an attacker can control this source text, they can craft payloads designed to escape the intended serialization boundaries. Specifically, the vulnerability arises because the library fails to properly escape closing script tags within the generated output when certain conditions regarding function source manipulation are met.
From a technical perspective, the exploit mechanism relies on the interaction between how serialize-javascript handles string escaping and how browsers parse HTML containing embedded scripts. When an application uses this library to embed serialized data directly into an HTML page without additional context-aware encoding, it assumes that the output will remain inert text within script blocks. However, by ending a serialized function's source with an unescaped closing script tag sequence, such as </script>, the attacker effectively terminates the current script element in the DOM structure. This allows subsequent content to be interpreted not as JavaScript code but as HTML markup. The browser then parses this injected markup and executes any event handlers or scripts contained within it, leading to arbitrary code execution within the victim's browser context.
The operational impact of this vulnerability is severe, particularly for applications that rely on server-side rendering or dynamic script injection where user-controlled data influences the serialized output. Successful exploitation enables attackers to perform full cross-site scripting attacks, including stealing session cookies, hijacking user sessions, defacing web pages, and performing actions on behalf of authenticated users. Because the attack vector involves manipulating function serialization logic, it may bypass traditional input validation filters that focus only on direct string injection rather than object property manipulation or prototype pollution techniques. This makes detection more difficult for automated security scanners that do not simulate complex JavaScript execution environments to detect such logical flaws in data processing libraries.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. The attack technique corresponds to ATT&CK tactic TA0001, Initial Access, specifically the T1189 drive-by compromise or T1059 command and script interpretation if the injected code executes arbitrary commands via browser APIs. It also relates to CWE-20 Improper Input Validation because the library fails to validate that serialized content does not contain sequences capable of breaking out of their intended syntactic context. The root cause is a lack of robust escaping mechanisms for special characters within function source strings, particularly when those sources are derived from dynamic or potentially untrusted objects whose toString methods have been overridden by malicious actors.
Mitigation strategies must prioritize immediate upgrading to serialize-javascript version 7.1.3 or later, where the developers have addressed this specific edge case in their serialization logic. For applications unable to upgrade immediately due to dependency constraints, defensive coding practices should be implemented at the application layer. Developers should ensure that any data passed through serialization libraries is strictly validated and sanitized before being embedded into HTML contexts. Additionally, implementing Content Security Policy headers can significantly reduce the impact of successful exploitation by restricting the sources from which scripts can be loaded and executed. It is also advisable to avoid using innerHTML or similar DOM manipulation methods for injecting serialized content directly; instead, use textContent where possible or ensure proper encoding is applied at multiple layers of the application stack to prevent context confusion between JavaScript strings and HTML markup.