Description
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yahoo | serialize-javascript | 7.0.1 – < 7.1.3 | 7.1.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-serialize-javascript | 7.1.4+~5.0.4-1 | — |
| Debian 13 | node-serialize-javascript | No fix yet | — |
| Debian 12 | node-serialize-javascript | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-serialize-javascript | No fix yet | — |
| Ubuntu 26.04 LTS | node-serialize-javascript | No fix yet | — |
| Ubuntu 24.04 LTS | node-serialize-javascript | No fix yet | — |
| Ubuntu 22.04 LTS | node-serialize-javascript | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.13-0.6.hum1 | RHSA-2026:93601 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 25+475.275dd4727-56.1 | openSUSE-SU-2026:12424-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-tensorboard | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | serialize-javascript | < 7.1.3 | 7.1.3 | GHSA-m5mm-p8h7-m29v |
Advisories 2
- RHSA-2026:93601 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- openSUSE-SU-2026:12424-1 agama-web-ui-25+475.275dd4727-56.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026
References
- GitHub Security Advisory (GHSA-m5mm-p8h7-m29v) vendor-advisory
- https://github.com/yahoo/serialize-javascript/pull/235 patch issue-tracking
- https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 patch
- serialize-javascript v7.1.3 Release Notes release-notes
- VulnCheck Advisory: serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body third-party-advisory