Source: node-serialize-javascript Version: 7.1.2+~5.0.4-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-serialize-javascript. CVE-2026-115754[0]: | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site | scripting vulnerability that allows attackers to break out of HTML | script elements by ending serialized function source text with an | unescaped </script. Attackers controlling a function's source via a | spoofed toString() can combine surrounding output delimiters and | later values to inject live markup such as img onerror handlers. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115754 https://www.cve.org/CVERecord?id=CVE-2026-115754 [1] https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v [2] https://github.com/yahoo/serialize-javascript/pull/235 [3] https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
