Cross-Site Scripting Vulnerability in Serialize-Javascript by Yahoo
CVE-2026-115754

2.3LOW

Key Information:

Vendor

Yahoo

Status
Serialize-javascript
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115754?

The serialize-javascript library, prior to version 7.1.3, is affected by a cross-site scripting vulnerability. An attacker can exploit this by manipulating serialized function source code, potentially injecting harmful scripts through an unescaped '' tag present in the content. This allows attackers with control over a function's toString() method to create malicious output, leading to the execution of arbitrary JavaScript on unsuspecting users' browsers.

Affected Version(s)

serialize-javascript 7.0.1 < 7.1.3

References

https://github.com/yahoo/serialize-javascript/security/ad...
vendor-advisory
https://github.com/yahoo/serialize-javascript/pull/235
patchissue-tracking
https://github.com/yahoo/serialize-javascript/commit/2864...
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.