AIKIDO-2026-179900

TL;DR

serialize-javascript escapes </script> sequences inside serialized function bodies so its output can be embedded safely in an inline HTML script element. The escaping only matches a complete </script...> tag within a single serialized value, so a closing script tag split across two separately serialized function bodies is left intact. When the serialized output is written into an HTML script context, the pieces reassemble into a real </script> sequence, break out of the script element, and let injected markup run in the browser. The fix escapes bare </script prefixes at HTML tokenizer delimiters and tracks string, template, regex, and comment spans so the split payload cannot be reassembled.