CVE-2026-116583— Seroval: Code injection through a typed array's own constructor property

Quick assessment

Affected

lxsmnsyc seroval

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Seroval 支持 JavaScript 值的序列化，其能力超越了 JSON.stringify，能够处理更复杂的结构。在 1.6.0 至 1.6.11 版本中，JavaScript 输出 API 会从值的一个属性中推导类型数组（Typed Array）的构造函数名称；而该属性可能被替换为自定义的构造函数属性。当应用程序代码将不可信的属性复制到一个类型数组上，随后将其传递给 serialize、serializeAsync、crossSerialize、crossSerializeAsync、crossSeria

CVSS 5.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Seroval: Code injection through a typed array's own constructor property

Source: CVE Program / CVE List V5

Vulnerability Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
lxsmnsyc	seroval	>= 1.6.0, < 1.6.11	-

II. Public POCs for CVE-2026-116583

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116583

请登录查看更多情报信息。

Other References for CVE-2026-116583 (3)

https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11 x_refsource_MISC
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116583

Same Patch Batch · lxsmnsyc · 2026-10-26 · 5 CVEs total

CVE-2026-116581	7.5 HIGH	Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116584	7.5 HIGH	Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
CVE-2026-116580	7.3 HIGH	Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance c
CVE-2026-116582	4.7 MEDIUM	Seroval: Script injection through RegExp sources in serialized output

IV. Related Vulnerabilities

Same product: seroval

Same vendor: lxsmnsyc

Same weakness: CWE-79