CVE-2026-116583 Details
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
A vulnerability in the Seroval JavaScript library, affecting versions 1.6.0 through 1.6.11, allows for code injection via typed arrays. The issue arises because the library's output APIs derive a typed array's constructor name from a property that can be manipulated. When application code transfers untrusted properties onto a typed array and then uses certain serialization functions, the injected constructor name is executed as JavaScript in the output context. This vulnerability is particularly concerning because it could lead to the execution of arbitrary code in the page that processes the serialized output.
Users can upgrade to Seroval version 1.6.11, which addresses the vulnerability by ensuring that the constructor name is sourced from the array's internal type, preventing manipulation through untrusted properties. If an upgrade is not possible, avoid copying untrusted properties onto typed arrays or remove any custom 'constructor' properties before serialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1 | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lxsmnsyc seroval | >= 1.6.0, < 1.6.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |