Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Description

serialize-javascript escapes its output so it is safe to embed inside a <script> element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped </script> into the output, terminating the script element early so the remainder is parsed as HTML.

Recommendation

Update the serialize-javascript package to the latest compatible version. Followings are version details:

• Affected version(s): >= 7.1.1, < 7.1.2
• Patched version(s): 7.1.2

References

• GHSA-gfhx-hw2g-v5hg
• CVE-2026-97711
• CWE-79
• CWE-80
• CAPEC-310