{"id":"ghsa-ghsa-f86p-h4j2-7qgj","seq":2056913,"kind":"advisory","title":"Seroval: Code injection through a typed array's own constructor property","url":"https://github.com/advisories/GHSA-f86p-h4j2-7qgj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f86p-h4j2-7qgj","summary":"影響: npm:seroval >= 1.6.0, < 1.6.11 → 1.6.11\nseroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output. Details Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own constructor property serialize correctly. Typed arrays still took the c…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-116583"],"tags":["GHSA-f86p-h4j2-7qgj","seroval"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:17:36.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}