yahoo CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW yahoo CVE published 2026-10-23

CVE-2026-115897

The CVE-2026-115897 vulnerability in the serialize-javascript package allows for cross-site scripting (XSS) via unescaped </script at the end of a serialized function body. This occurs because the package did not properly escape function values whose source ends in a bare </script before version 7.1.3. An attacker could potentially exploit this by injecting malicious scripts, but the exact impact and affe [truncated]