CVE-2026-116582 Details
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.
A vulnerability in Seroval versions prior to 1.0.0 and between 1.5.5 and 1.6.10 allows for script injection through regular expressions serialized by the library. The issue arises because the serialization process does not properly escape less-than characters in regular expression sources, which can then be used to close an HTML script element and execute arbitrary scripts on behalf of the user. This vulnerability is particularly concerning when an application builds regular expressions from untrusted input and embeds the serialized output in a script element.
Upgrade to Seroval version 1.6.10 or later, where this vulnerability has been fixed. If an upgrade is not possible, avoid serializing regular expressions built from untrusted input, or reject patterns containing less-than characters before serialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6 | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lxsmnsyc seroval | < 1.0.0 (semver) >= 1.5.5, < 1.6.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |