Serialize JavaScript allows functions to be serialized into a superset of JSON that supports functions and regexes. In versions prior to 7.1.3 the serialization logic fails to escape a match of the literal string "</script" when it appears at the end of the function source. Because each function body is escaped independently, a serializing context that surrounds the function with a closing </script> tag can prematurely terminate the host script element. A subsequent serialized value containing attacker‑controlled markup then becomes part of the rendered page. The vulnerability enables the injection of arbitrary HTML and JavaScript into web pages, giving an attacker the ability to perform standard cross‑site scripting attacks such as defacement, cookie theft, and session hijacking.

The Yahoo serialize-javascript library is affected. All releases prior to version 7.1.3 contain the flaw; updating to v7.1.3 or later removes the issue.

The CVSS score is 2.1, indicating low severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can influence the source code of a function that is later serialized, such as by providing a spoofed toString implementation. If the serialized output is embedded directly into a web page, the parameterized </script> sequence can break out of the script element and inject controlled markup. While the likelihood of exploitation appears limited, the impact of successful XSS remains non‑trivial.