{"id":"CVE-2026-116583","published":"2026-10-26T21:18:16.653","lastModified":"2026-10-26T21:18:17.010","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj","tags":[]}],"exploitRefs":[{"url":"https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj","tags":[]}],"hasPoc":true,"ai":null}