Description
seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
Affected version(s): **< 1.0.0 >= 1.5.5, < 1.6.10** Patched version(s): **1.0.0 1.6.10**
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: Script injection through RegExp sources in serialized output and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval: Code injection through a typed array's own constructor property - CVE-2026-116583
- i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query s - CVE-2026-118258
- protobuf.js: Code injection through bytes field defaults in generated toObject code - CVE-2026-44293
- xmldom has XML node injection through unvalidated processing instruction serialization - xmldom - CVE-2026-41675
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026