CVE-2026-115897

What it actually does

Improper neutralization of a bare closing-script prefix in function-source escaping allows a serialized function body to terminate an HTML script element when attacker-controlled function source (e.g., via spoofed toString) ends at that prefix; subsequent serialized values then inject live markup.

Why it matters to the business

Applications that serialize attacker-influenced data containing functions become susceptible to script injection, enabling theft of user data or unauthorized actions within the affected web pages; low prevalence and recent disclosure mean immediate but contained risk for most organizations.

How an attack unfolds

An attacker first gains control of a function's source text (commonly by overriding toString), crafts it to terminate exactly at </script>, then supplies additional serialized values that become executable HTML elements once the surrounding output closes the script tag.

How to fix it

Upgrade the serialize-javascript package to version 7.1.3 or later; re-test all code paths that serialize objects with function properties; consider replacing custom toString overrides that could supply untrusted source text.

How to confirm the fix worked

Confirm the installed version is at least 7.1.3; attempt to serialize a function whose source ends with </script> and verify that the output no longer produces a prematurely closed script element followed by injected markup.

Typical attack path

1. Identify an endpoint or feature that serializes objects containing functions using the vulnerable library
2. Craft or influence a function whose toString() output ends with a bare </script> delimiter
3. Trigger serialization of the malicious function followed by attacker-supplied markup in a later value
4. Deliver the resulting serialized string to a victim page where it is interpreted as HTML

How to detect it

Search web-application or proxy logs for serialized output containing unescaped </script> sequences immediately followed by unexpected HTML tags; inspect server-side serialization calls that accept function-bearing objects from user input.

What your security team should do

• Immediately inventory all direct and transitive dependencies for serialize-javascript and schedule upgrade to 7.1.3
• Add dependency pinning and automated scanning to prevent future regressions below the fixed version
• Review application code for any use of function serialization or toString overrides that feed into this library
• Monitor for new exploit maturity indicators given the three-day disclosure window