DailyCVE@dailycve
🔵 serialize-#javascript, Cross-site Scripting (XSS), #CVE-2026-97711 (Low) -DC-Sep2026-2683 https://dailycve.com/serialize-javascript-cross-site-scripting-xss-cve-2026-97711-low-dc-sep2026-2683/
0000023
238 followersView on X
CVE-2026-97711
LOWCVSS 2.3 · LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-79
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day