{"id":"ghsa-ghsa-9wx9-5pv9-3349","seq":2056914,"kind":"advisory","title":"Seroval: Script injection through RegExp sources in serialized output","url":"https://github.com/advisories/GHSA-9wx9-5pv9-3349","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9wx9-5pv9-3349","summary":"影響: npm:seroval >= 1.5.5, < 1.6.10 → 1.6.10, npm:seroval < 1.0.0 → 1.0.0\nseroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. - Version 1.5.5 stopped escaping element, as server rendering usually does. In that case an attacker can run script in the page of any user who receives that output. Patches Fixed in 1.6.10. A RegExp whose source…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-116582"],"tags":["GHSA-9wx9-5pv9-3349","seroval","seroval"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:17:31.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}