serialize-javascript Let a </script> Inside Data Close the Tag

serialize-javascript through 7.1.1 failed to escape </script> inside serialized function bodies. The library is built for exactly the case where its output gets inlined into an HTML document, and that is where the bug bites: a closing tag appearing in the payload ends the surrounding script element early, and whatever follows executes as markup.

The advisory rates it low severity, and that rating is worth reading carefully rather than dismissing. Exploitation requires that attacker-controlled data reach a serialized function body that is then inlined into HTML. That is a narrow path, but it is a real one in the pattern the library exists to serve, such as server-rendered state hydrated into a page. It is a cross-site scripting primitive on that path.

Fixed in 7.1.2, which shipped September 23 and is tracked as CVE-2026-97711. The affected range starts at 7.1.1, so earlier 7.x releases are not covered by this specific advisory and need their own check.

If you inline serialized output into a script tag anywhere, bump to 7.1.2. If your serialized data is only ever returned as JSON over an API and never embedded in markup, the injection path is closed and this can ride a normal dependency update.