DailyCVE@dailycve
🟠 Seroval, Cross-site Scripting, #CVE-2026-116582 (Medium) -DC-Oct2026-3919 https://dailycve.com/seroval-cross-site-scripting-cve-2026-116582-medium-dc-oct2026-3919/
0000022
247 followersView on X
CVE-2026-116582
LOWCVSS 4.7 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-79CWE-116
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day