serialize-javascript EUVD-2026-89027

Exploitation requires serialize-javascript 7.1.1 (fixed in 7.1.2) AND the consuming application must serialize a FUNCTION value whose source string is attacker-influenced AND embed that serialized output inside an HTML <script> element. Ordinary data values and options.isJSON output are NOT affected. The attacker must craft function source containing a </script in plain-code position (e.g. 'x</script=+/') followed later by a real </script> so a single SCRIPT_CLOSE_REGEXP match spans and swallows the inner closing tag. Limiting factors: only the 7.1.1 release is vulnerable, only function serialization is affected, victim page rendering (user interaction) is needed to trigger the injected markup, and the impact is XSS in the page origin rather than server compromise - no confidentiality/integrity/availability impact to the vulnerable system itself.

This is a genuine but low-severity, narrow-window XSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) yields only 2.3 because the impact is confined to subsequent-system integrity/confidentiality (SC:L/SI:L, VC/VI/VA all N) and requires both an attack requirement (AT:P) and passive user interaction (UI:P). No EPSS score, KEV listing, or public exploit was provided; per the precision rules this is 'no public exploit identified at time of analysis' (the exploit-shaped strings in the diff are regression tests shipped with the fix, PSECBUGS-117112, not weaponized public POC - do not conflate them). The decisive limiting factor is that ONLY function values are affected: an application must serialize a function whose source is attacker-influenced AND embed that output inside a <script> element, and only serialize-javascript versions 7.1.1 through 7.1.1 (fixed 7.1.2) are vulnerable. That is a very narrow production pattern - most consumers serialize data, not attacker-controlled functions - so despite the product's enormous footprint this is a real-but-low priority. Signals are consistent: low CVSS, no exploitation evidence, and a tightly-scoped trigger all agree this is not an urgent, widespread threat.

An application uses serialize-javascript 7.1.1 to embed a function whose source string is influenced by attacker input, and injects the result into an inline <script> block. The attacker crafts function source such as 'return x</script=+/ + "</script><img src=x onerror=alert(1)>"' so the flawed SCRIPT_CLOSE_REGEXP swallows the inner </script> in one match, leaving it un-escaped; when the page renders, the surviving tag closes the script early and the remaining bytes parse as HTML, running attacker script in the page origin. No public exploit is known, though the fix commit ships regression tests demonstrating the vector.