CVE-2026-116582 in Seroval
Summary
by MITRE • 10/26/2026
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified involves a critical input validation flaw within the Seroval JavaScript library, specifically affecting versions prior to 1.0.0 and those ranging from 1.5.5 through 1.6.9. This issue manifests when the library is utilized to serialize regular expression objects that are constructed using untrusted user-supplied data. The core technical deficiency lies in the serialization process for JavaScript output APIs, which includes methods such as serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, and compileJSON. When these functions encounter a RegExp object whose source string contains special characters like less-than signs, they fail to apply necessary HTML entity escaping or proper quoting mechanisms required for safe embedding within an HTML script element context.
This lack of sanitization creates a direct pathway for Cross-Site Scripting attacks. In typical web application architectures, developers often embed serialized data directly into inline JavaScript blocks within HTML documents to facilitate client-side processing without additional server round-trips. If the serialized output contains unescaped less-than characters, an attacker can craft malicious input that terminates the opening script tag and injects arbitrary executable code. For instance, a crafted regular expression source could include sequences like </script><script>alert(1)</script>, effectively breaking out of the intended execution context. This allows the injection of scripts that execute in the browser of any user who views the affected page, leading to potential session hijacking, credential theft, or defacement depending on the application's privileges and data sensitivity.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages the trust users place in web applications to execute malicious scripts within their browsers. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Client-side Injection and potentially Command Line Interface Execution if the injected script interacts with other browser APIs or local storage mechanisms. The severity is heightened by the fact that it affects a utility library used for data serialization, meaning any application relying on Seroval for embedding complex JavaScript structures into HTML pages becomes susceptible unless specific mitigations are applied manually.
The operational impact of this vulnerability extends beyond simple script execution. Because regular expressions can be constructed dynamically from user input in many modern web applications, the attack surface is broad. An attacker does not need to exploit a separate injection point; they simply provide input that forms part of a regex pattern which is then serialized and embedded in HTML. This bypasses traditional Content Security Policy protections if those policies do not strictly enforce script source restrictions or nonce-based validation for inline scripts. The ability to terminate the script element allows for more complex payloads, including fetching external resources, exfiltrating cookies via fetch API calls, or performing phishing attacks by modifying the DOM structure of the page in real-time.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the Seroval library to version 1.6.10 or later, where this serialization flaw has been corrected with proper escaping logic for HTML contexts. For applications unable to update immediately due to dependency constraints, developers should implement manual sanitization of any regular expression sources before passing them to Seroval’s serialization functions. This involves ensuring that special characters such as less-than and greater-than signs are escaped or replaced with safe alternatives prior to serialization. Additionally, adopting a Content Security Policy that restricts inline script execution can significantly reduce the impact of this vulnerability by preventing the injected scripts from running even if they successfully break out of the serialized data block.
Furthermore, developers should review all instances where Seroval is used to embed data into HTML pages and consider alternative approaches such as using JSON-based data attributes with explicit parsing on the client side rather than direct script embedding. This architectural shift reduces reliance on complex serialization formats within HTML markup and leverages native browser security features for handling structured data. Regular security audits of third-party library usage are essential, particularly when those libraries handle untrusted input in contexts that interact directly with the Document Object Model or HTTP responses. By addressing this vulnerability through both software updates and defensive coding practices, organizations can effectively neutralize the risk associated with improper serialization of regular expressions in web applications.