AIKIDO-2026-390982

TL;DR

serialize-javascript escapes serialized values so they are safe to embed inside a <script> element, but SCRIPT_CLOSE_REGEXP matches from a bare </script all the way to the next unrelated >, letting one match swallow and re-emit a later, complete </script> tag untouched. A function value containing </script=+/ in code position (legal JavaScript, parsed as a comparison against a regex literal) followed by a string literal such as </script><img src=x onerror=alert(1)> reaches this path, terminating the surrounding script element early so the injected markup runs as live HTML in the page, leading to cross-site scripting. Only function values are affected; string and data values are escaped correctly. The fix excludes < from the regex's character class so a match can no longer span a second </script tag.