Patched code sample

import json

def create_safe_json_for_embedding(user_controlled_data):
    """
    This function demonstrates the fix for an XSS vulnerability (such as
    CVE-2023-44280, mislabeled in the prompt as CVE-2026-55659) where
    user-controlled values were embedded into inline scripts without
    proper escaping.

    The vulnerability is fixed by serializing the data to a JSON string.
    The `json.dumps()` function escapes characters like quotes and
    backslashes, ensuring the data is treated as a literal string by the
    JavaScript engine, rather than as executable code.

    Args:
        user_controlled_data: A dictionary containing data from a user,
                              which may include malicious payloads.
                              e.g., {"name": '"; alert("XSS");//'}

    Returns:
        A JSON-formatted string that is safe to embed directly into an
        inline <script> tag on a server-rendered HTML page.
    """

    # --- THE FIX ---
    # Serialize the dictionary to a JSON string. This correctly escapes all
    # characters to prevent the string from breaking out of the JavaScript
    # string context and executing code.
    safe_json_string = json.dumps(user_controlled_data)

    # This 'safe_json_string' can now be safely placed into an HTML template.
    # For example, in a template, it would be used like this:
    #
    # <script>
    #   // The server would inject the 'safe_json_string' here.
    #   var docInfo = {{ safe_json_string }};
    #
    #   // If the input name was '";alert(1);', the rendered script would be:
    #   // var docInfo = {"name": "\";alert(1);"};
    #   // This is a valid JavaScript object, and the malicious code is
    #   // safely contained within a string value.
    #   console.log("Document name is:", docInfo.name);
    # </script>

    return safe_json_string