GHSA-m5mm-p8h7-m29v Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

• npm serialize-javascript: < 7.1.3 → fixed in 7.1.3

Impact `serialize-javascript` escapes its output so it is safe to embed inside a `` element. Before 7.1.3 that guarantee did not hold for a function value whose source ends in a bare ``). A body ending exactly at `` followed by markup: ```js const serialize = require('serialize-javascript'); function f() {} f.toString = () => 'function f(){ return 1 }// 'function g(x){ return x } > '; serialize({ a: { f }, g }, { space: 2 }); // { // "a": { // "f": function f(){ return 1 }// // } ``` Embedded in a `` element, the script ends at the injected tag and the `` becomes a live element in the page. Exploitation requires an attacker to control the source text of a serialized function, in practice through a spoofed `toString()`. Real functions always end in `}`, so ordinary function values are not affected, and non-function values (including strings containing `</script`) are escaped correctly. Patches Fixed in 7.1.3 (#235). The bare `</script` form is now also matched at the end of the function body, so it is escaped regardless of what follows it in the output. Workarounds Upgrade to 7.1.3. If you cannot upgrade, do not serialize function values whose source text (or `toString()`) can be influenced by an attacker. Credits Reported by ha_kr25** via the Yahoo bug bounty program.