Live › vulnerability › CVE-2026-116582
Go to dashboardSeroval serializes JavaScript values, and from 1.5.5 until 1.6.10 (and all versions before 1.0.0) it does not escape a less-than character in RegExp sources when the output is placed in an HTML script element. An attacker who controls regular expression text that the application serializes can end the script element and run JavaScript in another user's page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that turn untrusted input into regular expression syntax, serialize that RegExp with Seroval's JavaScript-output APIs, and embed the result in an HTML script element. Applications that do not serialize user-built RegExps into HTML, or that run a version outside the affected ranges, are not exposed.
No product ranges from the sources yet.
seroval version in the lockfile or with npm ls seroval.serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer or compileJSON that handle RegExp values built from user input and are embedded in a script tag.seroval to 1.6.10 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-116582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.