Your message dated Sat, 24 Oct 2026 19:52:37 +0000
with message-id <[email protected]>
and subject line Bug#1151937: fixed in node-serialize-javascript 7.1.4+~5.0.4-1
has caused the Debian Bug report #1151937,
regarding node-serialize-javascript: CVE-2026-115754
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151937: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151937
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-serialize-javascript
Version: 7.1.2+~5.0.4-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-serialize-javascript.
CVE-2026-115754[0]:
| serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site
| scripting vulnerability that allows attackers to break out of HTML
| script elements by ending serialized function source text with an
| unescaped </script. Attackers controlling a function's source via a
| spoofed toString() can combine surrounding output delimiters and
| later values to inject live markup such as img onerror handlers.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-115754
https://www.cve.org/CVERecord?id=CVE-2026-115754
[1]
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
[2] https://github.com/yahoo/serialize-javascript/pull/235
[3]
https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-serialize-javascript
Source-Version: 7.1.4+~5.0.4-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-serialize-javascript, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-serialize-javascript
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 21:31:57 +0200
Source: node-serialize-javascript
Architecture: source
Version: 7.1.4+~5.0.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1151937
Changes:
node-serialize-javascript (7.1.4+~5.0.4-1) unstable; urgency=medium
.
* Team upload
* New upstream release (Closes: #1151937, CVE-2026-115754)
Checksums-Sha1:
1485259aea92647f2239a10fbc61437a7e81147e 2678
node-serialize-javascript_7.1.4+~5.0.4-1.dsc
7a7c32248e207a0d29afed88e5ee3e921999c73d 2274
node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
8cf263e7eb0fa4fe5778f39494431bbad91d4c9a 18317
node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
22e9bc0e42349fc01ba1dd1c79c25922036ec425 4592
node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
Checksums-Sha256:
ab760b9faeefc09ef4360354484140a277f1bfe5c9cdc977b9dfd4a93126831a 2678
node-serialize-javascript_7.1.4+~5.0.4-1.dsc
3e878aa35290599dc273632e6492407652ba9fb226cc339bf5484f96d998e4d6 2274
node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
fc5cdec9e88bda63629bc5030a840c6d229a823f36b08dcc838c8dddb48ef19e 18317
node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
42974c874a48610bb1cad3e2990c8bbc79125d4658c69c2ac50ac66ee0afee51 4592
node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
Files:
4ca2fc0d195a1ece688c810c4227a49e 2678 javascript optional
node-serialize-javascript_7.1.4+~5.0.4-1.dsc
29a6c667929c3c9f358dd5c660dfe20a 2274 javascript optional
node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
501e160f67111e930bb2fd98299835cc 18317 javascript optional
node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
b84729e4cf1b2b65b2c65671a1a66fc5 4592 javascript optional
node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdCUQACgkQ9tdMp8mZ
7ulQNg/+Lh1o7eQ2Ee+crRytx9QhlOaRshseFTDI0hq2Pr7oqc9gNG2IjD60SLWZ
NrUjLB9gvzRx9Vo7TnmRKr7hTI7QhmvS73QKMD++KkIhqjd+St1KChbj0hnUx9bO
X/nGshR7TaDHuJyCySOh6mBDjKCjqpy2HIfjh2UdcI7xBagvArKxiGMcer9Q8J63
xZHfl/9gsry/m91YWoqlnNCoGTyFUjmjaw5JEjjiryKqhfq4jVO2KI8RpPv/lAuP
cvHnflE+5WQdYbcPyGP230MMaKJl3Ir/Bs7CxQzwjP2qY7+inNSvRyMe9TTRzUKt
bfxRF1mKsDwjYNauYZnT9i6nCBFSBIP6qNiqG01IznmOP8Tdfxqmx9l0tD7/Q9+P
20ki32E0iXB5240PXAV8mpXQ3+jy0nlpT55zGIgOa9LGhxlTWGwe9BN5pbl3D3l8
eHvQFKL9v5bZh+fitD22ByPWeSBr+Vmmnm2xnQyMSlONU/v0Z8cb6HCY29wq0qw4
/UNjxlqu5U4qKuV7VDOk9ONJ6Q+ZCOX3yXEQLCRKyAz+pF4vlNyHW0HsU3vPhen8
6sY4YZxcuL9MvMkgwtW2oXgOxakenfqcEhqgoZEAYC6o6494X0Ir0kmBtIBavtWv
ovVIxgpNG1kyNdVmADCN1HA3lVuc7DVaEQKJOb+9Nisl0Zxz3Vg=
=/qYw
-----END PGP SIGNATURE-----
pgpJEm0HX8oYC.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
