CVE-2026-116582: Seroval: Script injection through RegExp sources in serialized output

October 28, 2026

seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.

References

github.com/advisories/GHSA-9wx9-5pv9-3349
github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6
github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10
github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349
nvd.nist.gov/vuln/detail/CVE-2026-116582

Code Behaviors & Features

Detect and mitigate CVE-2026-116582 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →