Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions
    and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-
    script prefix when attacker-influenced function source text ends exactly at that prefix. Because each
    function body is escaped independently, a delimiter supplied by surrounding serialized output can
    terminate an HTML script element, and a later serialized value supplies injected markup that becomes a
    live element in the page. Exploitation requires control of a serialized function's source text, such as
    through a spoofed toString(). This issue is fixed in version 7.1.3. (CVE-2026-115897)

ID	Name	Product	Family	Type	Severity
477461	Chainguard: argo-workflows-ui-4.1: security update to 4.1.6-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
477461	Chainguard: argo-workflows-ui-4.1: security update to 4.1.6-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
477231	SCA: security update for serialize-javascript (GHSA-m5mm-p8h7-m29v)	Tenable Cloud Security	SCA Checks	Local	low
477231	SCA: security update for serialize-javascript (GHSA-m5mm-p8h7-m29v)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-115897

low

Tenable Plugins

low

low

low

low