serialize‑javascript 7.0.1 through 7.1.2 contains an XSS flaw that allows an attacker to terminate a serialized function’s source text with an unescaped </script tag. By controlling the function’s toString() output, a malicious actor can break out of an enclosing HTML script element and inject arbitrary markup, such as image tags with onerror handlers, that will execute scripts when rendered in a browser. The impact is the execution of attacker‑supplied code within the victim’s browser context, leading to potential data theft, session hijacking, or defacement.

The vulnerability affects the Yahoo serialize‑javascript library, specifically any installation of version 7.0.1 up to and excluding 7.1.3.

With a CVSS score of 2.3, the flaw is considered low severity, and no EPSS data is available. It is not listed in the CISA KEV catalog, indicating no known exploitation activity. The attack vector requires a web application that serializes function objects and includes serialize‑javascript; an attacker who can supply a function with a malicious toString() will achieve the XSS, but the exploitation relies on client‑side execution and does not bypass authentication.