JavaScript Serialization Vulnerability in Seroval by lxsmnsyc
CVE-2026-116582
4.7MEDIUM
What is CVE-2026-116582?
Seroval, a JavaScript library, contains a vulnerability that affects its output APIs, allowing serialized RegExp sources to introduce security risks. When building regular expression syntax from untrusted input and embedding the output in an HTML script element, an attacker can manipulate the RegExp source to terminate the script element improperly. This behavior facilitates the injection of malicious scripts into web pages viewed by other users. The issue has been addressed in version 1.6.10, where proper escaping mechanisms have been implemented to mitigate the risk associated with the less-than character.
Affected Version(s)
seroval < 1.0.0 < 1.0.0
seroval >= 1.5.5, < 1.6.10 < 1.5.5, 1.6.10