JavaScript Value Stringification Vulnerability in Seroval by lxsmnsyc
CVE-2026-116580

7.3HIGH

Key Information:

Vendor

Lxsmnsyc

Status
Seroval
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116580?

The vulnerability in Seroval arises from a flaw that allows for improper handling of untrusted input during the JavaScript value stringification process. Before version 1.6.8, the fromJSON method could reconstruct an AsyncIteratorFactoryInstance without validating the source, potentially allowing malicious input to trigger a deserialization of unsafe values. This could lead to various security issues depending on the behavior of the application plugin involved. The problem represents an incomplete fix related to prior vulnerabilities, emphasizing the need to validate input rigorously to maintain the application's security posture.

Affected Version(s)

seroval < 1.6.8

References

https://github.com/lxsmnsyc/seroval/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d...
x_refsource_MISC
https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.