DailyCVE@dailycve
🔵 Seroval, Code Injection, #CVE-2026-116583 (Low) -DC-Oct2026-3939 https://dailycve.com/seroval-code-injection-cve-2026-116583-low-dc-oct2026-3939/
0000029
247 followersView on X
CVE-2026-116583
LOWCVSS 5.3 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-79CWE-94
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day