CVE-2026-116582
Deferred Deferred - Pending Action

Seroval RegExp Source HTML Injection Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-27
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116582
EUVD
EUVD-2026-110449

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lxsmnsyc seroval < 1.0.0
lxsmnsyc seroval >= 1.5.5, < 1.6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Seroval is a JavaScript library that converts complex data structures into strings. A flaw in versions before 1.0.0 and between 1.5.5 to 1.6.9 allows unescaped less-than characters in regular expression sources when serialized. If an application uses untrusted input to build regex patterns, serializes them with Seroval, and embeds the result in an HTML script tag, attackers could inject malicious JavaScript code.

Detection Guidance

This vulnerability involves RegExp sources with less-than characters being improperly escaped in HTML script elements. Detection requires checking applications using Seroval versions before 1.0.0 or between 1.5.5 and 1.6.10 that serialize RegExp objects to HTML. Review code for untrusted input used in RegExp construction and serialization to HTML.

Impact Analysis

If you use an affected version of Seroval in an application that processes untrusted input for regex patterns and embeds serialized output in HTML, attackers could execute arbitrary JavaScript in the context of your users' browsers. This could lead to data theft, session hijacking, or defacement of your application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Upgrade Seroval to version 1.6.10 or later. Identify and patch applications using affected Seroval versions that serialize RegExp objects to HTML. Remove untrusted input from RegExp construction or implement strict input validation and output encoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart