CVE-2026-116583

Deferred Deferred - Pending Action

Seroval JavaScript Serialization Constructor Name Injection

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-116583

EUVD

EUVD-2026-110462

Affected Vendors & Products

Vendor	Product	Version / Range
lxsmnsyc	seroval	>= 1.6.0, < 1.6.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Seroval is a JavaScript library for serializing complex data structures. Between versions 1.6.0 and 1.6.11, an attacker could manipulate the constructor name of a typed array by replacing its property. When this array is passed to certain Seroval functions, the attacker-controlled name is written as executable JavaScript, leading to code execution in the receiving page.

Impact Analysis

If you use Seroval versions 1.6.0 to 1.6.11 in your application, an attacker could inject malicious JavaScript code. This could lead to unauthorized actions, data theft, or further compromise of user sessions, depending on the application's context.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if user data is exposed or altered due to the exploit.

Mitigation Strategies

Update Seroval to version 1.6.11 or later to address the vulnerability. Avoid passing untrusted properties to Seroval's JavaScript-output APIs.

Hi! I’m here to help you understand CVE-2026-116583. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70