CVE-2026-115897 yahoo CVE debrief

Who should care

Defenders responsible for npm package management, web application security, and Content Security Policy (CSP) should assess the potential impact of this vulnerability on their deployments and take necessary remediation steps.

Why it matters

The CVE-2026-115897 vulnerability in serialize-javascript allows for XSS attacks via unescaped </script in function body. Defenders should verify versions, assess deployment contexts, and prioritize upgrading to version 7.1.3 or later.

• XSS attacks via unescaped </script in serialized function bodies
• Potential for malicious script injection in <script> elements
• Need for verification of affected versions and deployments
• Priority for upgrading to version 7.1.3 or later

Technical summary

The serialize-javascript package before version 7.1.3 did not properly escape function values whose source ends in a bare </script>. This could lead to cross-site scripting (XSS) attacks when such values are embedded in a <script> element. The vulnerability is resolved in version 7.1.3. Affected product deployments should be verified, and defenders should assess the potential for XSS attacks in their deployment contexts, particularly where user-supplied input is serialized. Upgrading to version 7.1.3 or later is recommended.

Defensive priority

Defenders should prioritize verifying the versions of serialize-javascript in use and upgrading to version 7.1.3 or later if necessary. They should also assess the potential for XSS attacks in their deployment contexts, particularly where user-supplied input is serialized.

Recommended defensive actions

• Verify the version of serialize-javascript in use and upgrade to version 7.1.3 or later if necessary.
• Assess the potential for XSS attacks in deployment contexts where user-supplied input is serialized.
• Implement additional security measures to detect and prevent XSS attacks, such as output encoding and Content Security Policy (CSP).
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence provided indicates that the serialize-javascript package did not properly handle function values ending in </script before version 7.1.3. This could lead to XSS attacks when such values are embedded in a <script> element. However, the exact scope of affected versions and deployments requires further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.