ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116583

Seroval: Code injection through a typed array's own constructor property

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116583. EPSS is 0.27%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium4.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.27%
Remediation
Version ranges on file
Affected products
npm seroval

### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output. ### Details Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array's real type. These functions are affected: - , - , , - the class - and are not affected: they only accept the names of the built-in typed arrays. With the option, the same lookup throws a instead of writing code. ### Impact An application is affected only when it serializes a typed array that has an own property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output. ### Patches Fixed in 1.6.11. The constructor name now comes from the array's internal type, which properties on the value cannot change. uses the real type as well. ### Workarounds If you cannot upgrade, do not copy properties from untrusted objects onto typed arrays, or remove an own property from a typed array before serializing it.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm seroval>= 1.6.0, < 1.6.11

How to fix CVE-2026-116583

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116583. EPSS is 0.27%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with >= 1.6.0, < 1.6.11. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-79: Cross-site Scripting (XSS); CWE-94: Code Injection. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    seroval: seroval: Arbitrary code execution via untrusted typed array constructor properties

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output. ### Details Version 1.6.0 changed how seroval finds the class o

Sources

  • CVE.orgVulnerability recordCVE-2026-116583

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-f86p-h4j2-7qgj

    Seroval: Code injection through a typed array's own constructor property

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116583

    seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.

    advisories.gitlab.com
  • Red Hat Security DataVendor advisoryCVE-2026-116583

    seroval: seroval: Arbitrary code execution via untrusted typed array constructor properties

    access.redhat.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • CVE.orgOct 27, 2026
  • Red Hat Security DataOct 27, 2026