CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

• CWE-79
• CWE-94

• https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj

Published

Oct 26, 2026

Last Modified

Oct 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7
• CVE-2026-116584Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116585Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116586Go JOSE provides an implementation of the Javascript Object …6.9
• CVE-2026-116587Go JOSE provides an implementation of the Javascript Object …7.5
• CVE-2026-116588Datadog dd-trace-py is the Datadog Python APM client. From 1…8.7
• CVE-2026-116589Datadog dd-trace-py is the Datadog Python APM client. From 3…8.2