CVE-2026-116582

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.

• CWE-79
• CWE-116

• https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116577Tornado is a Python web framework and asynchronous networkin…5.3
• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116583Seroval facilitates JavaScript value stringification, includ…5.3
• CVE-2026-116584Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116585Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116586Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5
• CVE-2026-116588Datadog dd-trace-py is the Datadog Python APM client. From 1…8.7