CVE-2026-115754 in serialize-javascript
要約
〜によって MITRE • 2026年10月23日
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.