Serialize JavaScript serializes values to a superset of JSON that includes function literals. An attacker can supply function source containing an unescaped closing script tag, which is not fully shielded by the library’s closing‑tag regex. When the serialized function is embedded directly inside a <script> element in a web page, the stray </script> prematurely terminates the element and the remaining text is parsed as HTML, allowing an attacker to inject arbitrary script content. Only function values are affected; ordinary data values and JSON‑only output are not impacted.

The flaw exists in Yahoo's serialize‑javascript library, specifically in version 7.1.1. Releases from 7.1.1 up to, but not including, 7.1.2 are vulnerable, and the issue is fixed in 7.1.2.

The CVSS score is 2.3, indicating a low severity against confidentiality, integrity, and availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that a web application embed the serialized function output directly into a <script> tag without proper escaping. The attack, therefore, depends on client‑side rendering code that trusts untrusted function bodies and is limited to scripts that run in the originating page context.