CVE-2026-116582— Seroval: Script injection through RegExp sources in serialized output

Quick assessment

Affected

lxsmnsyc seroval

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Seroval 支持 JavaScript 值的字符串化，能够处理超出 JSON.stringify 能力的复杂结构。在 1.0.0 之前，以及从 1.5.5 到 1.6.10 的版本中，其 JavaScript 输出 API 在序列化包含小于号（<）的正则表达式源字符串时，未对 HTML 元素所需的字符进行转义。当应用程序从不可信输入构建正则表达式语法，并通过 serialize、serializeAsync、crossSerialize、crossSerializeAsync、crossSerializeStr

CVSS 4.7 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Seroval: Script injection through RegExp sources in serialized output

Source: CVE Program / CVE List V5

Vulnerability Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
lxsmnsyc	seroval	< 1.0.0	-

II. Public POCs for CVE-2026-116582

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116582

请登录查看更多情报信息。

Other References for CVE-2026-116582 (3)

https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10 x_refsource_MISC
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349 x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116582

Same Patch Batch · lxsmnsyc · 2026-10-26 · 5 CVEs total

CVE-2026-116581	7.5 HIGH	Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116584	7.5 HIGH	Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
CVE-2026-116580	7.3 HIGH	Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance c
CVE-2026-116583	5.3 MEDIUM	Seroval: Code injection through a typed array's own constructor property

IV. Related Vulnerabilities

Same product: seroval

Same vendor: lxsmnsyc

Same weakness: CWE-79