AZL-111401: CVE-2026-115754 affecting package python-tensorboard 2.16.2-6

Q: Under what conditions is an application exposed to this issue?

Exposure requires use of a vulnerable serialize-javascript version to serialize a function into HTML script-element output. An attacker must be able to control that function's source through a spoofed toString() value and influence surrounding output delimiters or later serialized values.

Q: What could successful exploitation allow?

An attacker could terminate the intended HTML script element with an unescaped </script> sequence and inject live HTML markup, including event-handler payloads such as an img onerror handler. This is a cross-site scripting vulnerability.

Published Oct 23, 2026

Updated

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.

Affected Software

1 affected component

azure-linux/python-tensorboard<=2.16.2-6

Event History

Oct 23, 2026

Advisory Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115754

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

Exposure requires use of a vulnerable serialize-javascript version to serialize a function into HTML script-element output. An attacker must be able to control that function's source through a spoofed toString() value and influence surrounding output delimiters or later serialized values.

What could successful exploitation allow?

An attacker could terminate the intended HTML script element with an unescaped </script> sequence and inject live HTML markup, including event-handler payloads such as an img onerror handler. This is a cross-site scripting vulnerability.

Which serialize-javascript versions are affected?

The issue affects serialize-javascript 7.0.1 through versions before 7.1.3. Version 7.1.3 is not described as affected.

AZL-111401: CVE-2026-115754 affecting package python-tensorboard 2.16.2-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

What could successful exploitation allow?

Which serialize-javascript versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Under what conditions is an application exposed to this issue?

What could successful exploitation allow?

Which serialize-javascript versions are affected?