CVE-2026-97711

CVE-2026-97711 · Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.

CVSS 2.3 · Faible · EPSS 0,3% · Correctif disponible

Publication

2026-09-29T16:00:33.534Z

Mise à jour

2026-09-29T16:53:35.013Z

Pile logicielle: system · node

Vérifiez votre serveur →