Vulnerability Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
Related Weaknesses (CWE)
References
- https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e
- https://github.com/lxsmnsyc/seroval/releases/tag/[email protected]
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
FAQ
What is CVE-2026-116583?
CVE-2026-116583 is a documented vulnerability. Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constr...
How severe is CVE-2026-116583?
CVSS scoring is not yet available for CVE-2026-116583. Check NVD for updates.
Is there a patch for CVE-2026-116583?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.