GHSA-gfhx-hw2g-v5hg Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

• npm serialize-javascript: >= 7.1.1, < 7.1.2 → fixed in 7.1.2

Impact `serialize-javascript` escapes its output so it is safe to embed inside a `` element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped `` into the output, terminating the script element early so the remainder is parsed as HTML. `SCRIPT_CLOSE_REGEXP` used `]*>` as its first alternative. The character class excludes only `>`, so a single match could run from one `` anywhere in the source — swallowing a second, complete `` along the way. Only one replacement is emitted per match, and the plain-code branch neutralizes just the leading `' }"; const out = serialize({ h: new Function('return ' + src)() }); // {"h":function f(x){ return x' }} ``` Embedded as the README documents (`window.S = `) and parsed by Chromium, the script element ends at the injected tag and the `` becomes a live DOM node with its `onerror` handler executing in the page origin. Only the function path is affected. The same payload passed as data is escaped correctly, and `options.isJSON` / non-function values are unaffected. Patches Fixed in 7.1.2. The wildcard now excludes `` (`[^<>]*`), so a match can never reach past a second ``, and emits anything else as text. Workarounds Upgrade to 7.1.2. If you cannot upgrade, 7.1.0 and earlier are unaffected, or avoid serializing functions whose source text is attacker-influenced. Regression note This is a regression specific to 7.1.1, not a long-standing issue. 7.1.0 and earlier applied the same wildcard but escaped the entire match, so no tag survived. Downstream scanners defaulting to a `>= 7.1.0` range would be overly broad.