{"id":"CVE-2026-116582","kind":"vulnerability","aliases":["CVE-2026-116582"],"related":[],"title":"Seroval: RegExp serialization lets crafted input break out of script tags","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.","summary":"Seroval serializes JavaScript values, and from 1.5.5 until 1.6.10 (and all versions before 1.0.0) it does not escape a less-than character in RegExp sources when the output is placed in an HTML script element. An attacker who controls regular expression text that the application serializes can end the script element and run JavaScript in another user's page.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","node","package","seroval"],"not_affected_if":["no-html-script-embedding","no-user-built-regexp","version-1.6.10-or-later"],"how_to_check":"- Check the installed `seroval` version in the lockfile or with `npm ls seroval`.\n- Search the codebase for calls to `serialize`, `serializeAsync`, `crossSerialize`, `crossSerializeAsync`, `crossSerializeStream`, `Serializer` or `compileJSON` that handle RegExp values built from user input and are embedded in a script tag.","fix":"- Upgrade `seroval` to `1.6.10` or later.\n- Until upgraded, do not build RegExp source from untrusted input that is serialized into HTML.","status":"open","published_at":"2026-10-26T21:18:16+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:18+00:00","updated_at":"2026-10-26T21:21:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T21:21:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `seroval` to `1.6.10` or later.\n- Until upgraded, do not build RegExp source from untrusted input that is serialized into HTML.","reach":"internet","title":"Seroval: RegExp serialization lets crafted input break out of script tags","impact":"high","summary":"Seroval serializes JavaScript values, and from 1.5.5 until 1.6.10 (and all versions before 1.0.0) it does not escape a less-than character in RegExp sources when the output is placed in an HTML script element. An attacker who controls regular expression text that the application serializes can end the script element and run JavaScript in another user's page.","category":"package","nicknames":[],"who_cares":["javascript","seroval","node","frontend"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs script in other users' browser sessions on the site.","analyst_note":"","how_to_check":"- Check the installed `seroval` version in the lockfile or with `npm ls seroval`.\n- Search the codebase for calls to `serialize`, `serializeAsync`, `crossSerialize`, `crossSerializeAsync`, `crossSerializeStream`, `Serializer` or `compileJSON` that handle RegExp values built from user input and are embedded in a script tag.","needs_analyst":false,"not_affected_if":["version-1.6.10-or-later","no-user-built-regexp","no-html-script-embedding"],"who_is_affected":"Applications that turn untrusted input into regular expression syntax, serialize that RegExp with Seroval's JavaScript-output APIs, and embed the result in an HTML script element. Applications that do not serialize user-built RegExps into HTML, or that run a version outside the affected ranges, are not exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":3459,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116582':14A,17A '-2026':13A,16A '1.0.0':36B,96C '1.5.5':29B,99C '1.6.10':31B,101C,183C 'affect':129C 'anoth':79B,175C 'api':106C 'applic':68B,127C 'attack':60B 'beyond':91C 'break':7A 'build':132C 'capabl':93C 'charact':45B,116C 'compilejson':150C 'complex':89C 'contain':111C 'control':62B 'craft':5A,161C 'crossseri':145C 'crossserializeasync':146C 'crossserializestream':147C 'cve':12A,15A 'element':58B,74B,125C,159C,166C 'emb':152C 'end':71B 'escap':40B,119C 'execut':168C 'express':64B,134C 'facilit':84C 'fix':180C 'frontend':18B 'html':56B,123C,157C 'includ':88C 'input':6A,138C 'issu':178C 'javascript':19B,25B,77B,85C,104C 'javascript-output':103C 'json.stringify':92C 'less':43B,114C 'less-than':42B,113C 'let':4A 'need':120C 'node':20B 'output':51B,105C 'packag':21B 'page':82B,172C 'place':53B 'prior':94C 'receiv':173C 'regexp':2A,47B,109C,141C 'regular':63B,133C 'result':154C 'run':76B 'script':10A,57B,73B,124C,158C,169C 'serial':3A,24B,69B,107C,139C,143C,148C 'serializeasync':144C 'serov':1A,22B,23B,83C 'sourc':48B,110C,162C 'stringif':87C 'structur':90C 'syntax':135C 'tag':11A 'termin':164C 'text':65B 'untrust':137C 'user':80B,176C 'valu':26B,86C 'version':34B,182C 'without':117C","nicknames":[],"mitigations":[],"who_affected":"Applications that turn untrusted input into regular expression syntax, serialize that RegExp with Seroval's JavaScript-output APIs, and embed the result in an HTML script element. Applications that do not serialize user-built RegExps into HTML, or that run a version outside the affected ranges, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116582","severity":null,"published_at":"2026-10-26T21:18:16+00:00","modified_at":"2026-10-26T21:18:16+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}