CVE-2026-116583
CVE-2026-116583 · Seroval: Code injection through a typed array's own constructor property
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
CVSS 5.3 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node