GHSA-M5MM-P8H7-M29V Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Impact serialize-javascript escapes its output so it is safe to embed inside a element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare . A body ending exactly at followed by markup: js const serialize = require'serialize-javascript'; function f f.toStrin...

npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

npm: Serialize JavaScript: Cross-site scripting XSS via unescaped /script at the end of a serialized function body vulnerability discovered by ? in WordPress npm serialize-javascript versions 7.1.3...

CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115754

The serialize-javascript library (versions 7.0.1 before 7.1.3 ) is vulnerable to a cross-site scripting (XSS) flaw. The root cause is the failure to escape the 삡cript tag within serialized function source text. Attackers who control a function's source—for example, through a spoofed toString() me...

CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

PT-2026-122085

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

CVE-2026-60119

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the sequence, which is not escaped by JSON.stringify when...

EUVD-2026-2733

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for...

CVE-2021-21700

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...