Hi,

The following vulnerability was published for node-serialize-javascript.

CVE-2026-115754[0]:
| serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site
| scripting vulnerability that allows attackers to break out of HTML
| script elements by ending serialized function source text with an
| unescaped </script. Attackers controlling a function's source via a
| spoofed toString() can combine surrounding output delimiters and
| later values to inject live markup such as img onerror handlers.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115754
https://www.cve.org/CVERecord?id=CVE-2026-115754
[1] https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
[2] https://github.com/yahoo/serialize-javascript/pull/235
[3] https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1151937 in node-serialize-javascript reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-serialize-javascript/-/commit/dcd00a86584ee750bdda3b234a3f8d43e73e9a61

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151937

Hello,

Bug #1151937 in node-serialize-javascript reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-serialize-javascript/-/commit/dcd00a86584ee750bdda3b234a3f8d43e73e9a61

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151937

We believe that the bug you reported is fixed in the latest version of
node-serialize-javascript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151937@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-serialize-javascript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 24 Oct 2026 21:31:57 +0200
Source: node-serialize-javascript
Architecture: source
Version: 7.1.4+~5.0.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1151937
Changes:
 node-serialize-javascript (7.1.4+~5.0.4-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream release (Closes: #1151937, CVE-2026-115754)
Checksums-Sha1:
 1485259aea92647f2239a10fbc61437a7e81147e 2678 node-serialize-javascript_7.1.4+~5.0.4-1.dsc
 7a7c32248e207a0d29afed88e5ee3e921999c73d 2274 node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
 8cf263e7eb0fa4fe5778f39494431bbad91d4c9a 18317 node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
 22e9bc0e42349fc01ba1dd1c79c25922036ec425 4592 node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
Checksums-Sha256:
 ab760b9faeefc09ef4360354484140a277f1bfe5c9cdc977b9dfd4a93126831a 2678 node-serialize-javascript_7.1.4+~5.0.4-1.dsc
 3e878aa35290599dc273632e6492407652ba9fb226cc339bf5484f96d998e4d6 2274 node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
 fc5cdec9e88bda63629bc5030a840c6d229a823f36b08dcc838c8dddb48ef19e 18317 node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
 42974c874a48610bb1cad3e2990c8bbc79125d4658c69c2ac50ac66ee0afee51 4592 node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
Files:
 4ca2fc0d195a1ece688c810c4227a49e 2678 javascript optional node-serialize-javascript_7.1.4+~5.0.4-1.dsc
 29a6c667929c3c9f358dd5c660dfe20a 2274 javascript optional node-serialize-javascript_7.1.4+~5.0.4.orig-types-serialize-javascript.tar.gz
 501e160f67111e930bb2fd98299835cc 18317 javascript optional node-serialize-javascript_7.1.4+~5.0.4.orig.tar.gz
 b84729e4cf1b2b65b2c65671a1a66fc5 4592 javascript optional node-serialize-javascript_7.1.4+~5.0.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrdCUQACgkQ9tdMp8mZ
7ulQNg/+Lh1o7eQ2Ee+crRytx9QhlOaRshseFTDI0hq2Pr7oqc9gNG2IjD60SLWZ
NrUjLB9gvzRx9Vo7TnmRKr7hTI7QhmvS73QKMD++KkIhqjd+St1KChbj0hnUx9bO
X/nGshR7TaDHuJyCySOh6mBDjKCjqpy2HIfjh2UdcI7xBagvArKxiGMcer9Q8J63
xZHfl/9gsry/m91YWoqlnNCoGTyFUjmjaw5JEjjiryKqhfq4jVO2KI8RpPv/lAuP
cvHnflE+5WQdYbcPyGP230MMaKJl3Ir/Bs7CxQzwjP2qY7+inNSvRyMe9TTRzUKt
bfxRF1mKsDwjYNauYZnT9i6nCBFSBIP6qNiqG01IznmOP8Tdfxqmx9l0tD7/Q9+P
20ki32E0iXB5240PXAV8mpXQ3+jy0nlpT55zGIgOa9LGhxlTWGwe9BN5pbl3D3l8
eHvQFKL9v5bZh+fitD22ByPWeSBr+Vmmnm2xnQyMSlONU/v0Z8cb6HCY29wq0qw4
/UNjxlqu5U4qKuV7VDOk9ONJ6Q+ZCOX3yXEQLCRKyAz+pF4vlNyHW0HsU3vPhen8
6sY4YZxcuL9MvMkgwtW2oXgOxakenfqcEhqgoZEAYC6o6494X0Ir0kmBtIBavtWv
ovVIxgpNG1kyNdVmADCN1HA3lVuc7DVaEQKJOb+9Nisl0Zxz3Vg=
=/qYw
-----END PGP SIGNATURE-----