https://vulnerability.circl.lu/sightings/feed 2026-10-01T15:54:34.335133+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a02acdc8-2743-4c46-8147-db7161b1a8e8/export 2026-10-01T15:54:34.368961+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a02acdc8-2743-4c46-8147-db7161b1a8e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-97711", "type": "seen", "source": "https://gist.github.com/alon710/628fa39fe9dad8563ac383f538499b83", "content": "# CVE-2026-97711: CVE-2026-97711: Cross-Site Scripting (XSS) via Unescaped Script-Closing Tags in serialize-javascript\n\n> **CVSS Score:** 2.3\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-97711\n\n## Summary\nA security vulnerability in serialize-javascript v7.1.1 allows Cross-Site Scripting (XSS) due to an overly greedy regular expression (SCRIPT_CLOSE_REGEXP) used during function serialization. Two secondary defects involving a spoofed toString() validation bypass and a stateful native code validator are also addressed in the fixed version v7.1.2.\n\n## TL;DR\nA failure to sanitize script-closing tags in serialize-javascript v7.1.1 allows unauthenticated Cross-Site Scripting (XSS) when serializing user-influenced function values embedded in HTML script elements.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 2.3\n- **EPSS Score**: N/A\n- **Impact**: Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using serialize-javascript for server-side rendering state serialization.\n- **serialize-javascript**: >= 7.1.0, <= 7.1.1 (Fixed in: `7.1.2`)\n\n## Mitigation\n\n- Upgrade serialize-javascript to version 7.1.2 or later.\n- Avoid embedding serialized outputs directly into inline script blocks.\n- Use HTML entity encoding on serialized outputs rendered in templates.\n\n**Remediation Steps:**\n1. Verify the current version of serialize-javascript in package-lock.json.\n2. Run 'npm install serialize-javascript@7.1.2' or 'npm update serialize-javascript'.\n3. Ensure any server-side rendered templates use safe hydration patterns like data attributes instead of inline executable script blocks.\n\n## References\n\n- [GitHub Security Advisory GHSA-gfhx-hw2g-v5hg](https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2g-v5hg)\n- [Fix Commit 2bdbaaf](https://github.com/yahoo/serialize-javascript/commit/2bdbaaff9cb8a4639135eb24cfcd383d3fefb534)\n- [Release v7.1.2](https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.2)\n- [NVD CVE-2026-97711 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-97711)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-97711)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-97711) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T17:30:30.000000Z"} 2026-09-30T17:30:30+00:00