CVE-2026-116583 — seroval
Fix: lxsmnsyc/seroval@1313ebbCVE-2026-116583 is a Cross-site Scripting (XSS) vulnerability in seroval. A fix is available for seroval — see the affected versions and patch details below.
Seroval: Code injection through a typed array's own constructor property
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-116583.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
serovalnpmDescription
Summary
seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.
Details
Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own constructor property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array's real type.
These functions are affected:
serialize,serializeAsynccrossSerialize,crossSerializeAsync,crossSerializeStream- the
Serializerclass compileJSON
fromJSON and fromCrossJSON are not affected: they only accept the names of the built-in typed arrays. With the compactArrayBufferViews option, the same lookup throws a TypeError instead of writing code.
Impact
An application is affected only when it serializes a typed array that has an own constructor property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.
Patches
Fixed in 1.6.11. The constructor name now comes from the array's internal type, which properties on the value cannot change. compactArrayBufferViews uses the real type as well.
Workarounds
If you cannot upgrade, do not copy properties from untrusted objects onto typed arrays, or remove an own constructor property from a typed array before serializing it.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | seroval | ≥ 1.6.0&&< 1.6.11 | 1.6.11npm install seroval@1.6.11 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for seroval, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update seroval to 1.6.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-116583 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2026-116583 in your dependencies?
Find it across npm, including transitive dependencies.