{"id":"EUVD-2026-110462","enisaUuid":"dbeac18c-7574-37bf-9e79-8d892996411b","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array\u0027s constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.","datePublished":"Oct 26, 2026, 8:49:35 PM","dateUpdated":"Oct 27, 2026, 2:18:01 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj\nhttps://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11\n","aliases":"CVE-2026-116583\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"572d0f36-d6d1-32d9-a44c-9c4dd4052adf","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"1.6.0, \u003c 1.6.11"}],"enisaIdVendor":[{"id":"0b899097-42f1-325e-9452-a9bd7227baba","vendor":{"name":"lxsmnsyc"}}],"enisaIdVulnerability":[{"id":"87e5831c-be16-3a87-b740-d663a2bcf2ca","vulnerability":{"id":"CVE-2026-116583","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array\u0027s constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.","datePublished":"Oct 26, 2026, 8:49:35 PM","dateUpdated":"Oct 27, 2026, 2:18:01 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj\nhttps://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11\n","enisa_id":"EUVD-2026-110462\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 28, 2026, 11:00:43 PM","vulnerabilityProduct":[{"id":"63ae1c01-3f19-39a2-821a-4beffbc3561e","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"1.6.0, \u003c 1.6.11"}],"vulnerabilityVendor":[{"id":"a4c14ad3-f6a6-354a-90dc-da675c203725","vendor":{"name":"lxsmnsyc"}}]}}],"enisaIdAdvisory":[]}