---
id: CVE-2026-116583
title: 'Seroval: Code injection through a typed array''s own constructor property'
summary: >-
  Seroval facilitates JavaScript value stringification, including complex
  structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the
  JavaScript-output APIs derive a typed array's constructor name from a property
  on the val…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-79
  - CWE-94
vendor: lxsmnsyc
product: seroval
affected:
  - 'seroval >= 1.6.0, < 1.6.11'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:41:53.434470Z'
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:18:01.418Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116583'
references:
  - url: >-
      https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
    label: >-
      https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
  - url: >-
      https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
    label: >-
      https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
  - url: 'https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11'
    label: 'https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11'
tags:
  - cve.org
epss: 0.00268
epssPercentile: 0.1883
ingestedAt: '2026-10-27T16:11:59.452Z'
---

## Overview

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

## Affected

- `seroval >= 1.6.0, < 1.6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.