What is CVE-2026-116582?

CVE-2026-116582 is a medium-severity cross-site scripting (XSS) vulnerability in seroval (npm), affecting versions >= 1.5.5, < 1.6.10. It is fixed in 1.6.10, 1.0.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.

How severe is CVE-2026-116582?

CVE-2026-116582 has a CVSS score of 4.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of seroval are affected by CVE-2026-116582?

seroval (npm) versions >= 1.5.5, < 1.6.10 is affected.

Is there a fix for CVE-2026-116582?

Yes. CVE-2026-116582 is fixed in 1.6.10, 1.0.0. Upgrade to this version or later.

Is CVE-2026-116582 exploitable, and should I be worried?

Whether CVE-2026-116582 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-116582 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-116582?

Upgrade: seroval to 1.6.10 or later, seroval to 1.0.0 or later.

CVE-2026-116582 in seroval

Q: How severe is CVE-2026-116582?

CVE-2026-116582 has a CVSS score of 4.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of seroval are affected by CVE-2026-116582?

seroval (npm) versions >= 1.5.5, < 1.6.10 is affected.

Q: Is there a fix for CVE-2026-116582?

Yes. CVE-2026-116582 is fixed in 1.6.10, 1.0.0. Upgrade to this version or later.

Q: Is CVE-2026-116582 exploitable, and should I be worried?

Whether CVE-2026-116582 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-116582 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-116582?

Upgrade: seroval to 1.6.10 or later, seroval to 1.0.0 or later.

Summary

Seroval: Script injection through RegExp sources in serialized output

seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.

Details

seroval escapes < in strings, so string values cannot end a <script> element. RegExp sources did not get the same escaping:

Versions before 1.0.0 wrote the source as is.
Version 1.5.5 stopped escaping < in RegExp sources, so that named groups and lookbehinds keep working. This removed the escaping for every < in a source.

These functions are affected:

serialize, serializeAsync
crossSerialize, crossSerializeAsync, crossSerializeStream
the Serializer class
compileJSON

toJSON, fromJSON, toCrossJSON and fromCrossJSON are not affected, because they never produce JavaScript.

Workarounds

If you cannot upgrade:

Do not serialize a RegExp built from untrusted pattern syntax. Send its source and flags as strings, and build the RegExp on the client.
Or reject patterns that contain < before they reach the serializer.

Impact

An application is affected when all of these are true:

It builds a RegExp from untrusted input that is used as regular expression syntax. Input passed through an escaping helper (such as an escapeRegExp function) is not enough to exploit this.
It serializes that RegExp with one of the functions above.
It places the output inside an HTML <script> element, as server rendering usually does.

In that case an attacker can run script in the page of any user who receives that output.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-116582 has a CVSS score of 4.7 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.6.10, 1.0.0); upgrading removes the vulnerable code path.

Affected versions

seroval (>= 1.5.5, < 1.6.10) seroval (< 1.0.0)

Security releases

seroval → 1.6.10 (npm) seroval → 1.0.0 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fixed in 1.6.10. A RegExp whose source contains < is now written with the RegExp constructor and an escaped string source. Named groups and lookbehinds keep working.

Frequently Asked Questions

What is CVE-2026-116582? CVE-2026-116582 is a medium-severity cross-site scripting (XSS) vulnerability in seroval (npm), affecting versions >= 1.5.5, < 1.6.10. It is fixed in 1.6.10, 1.0.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
How severe is CVE-2026-116582? CVE-2026-116582 has a CVSS score of 4.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of seroval are affected by CVE-2026-116582? seroval (npm) versions >= 1.5.5, < 1.6.10 is affected.
Is there a fix for CVE-2026-116582? Yes. CVE-2026-116582 is fixed in 1.6.10, 1.0.0. Upgrade to this version or later.
Is CVE-2026-116582 exploitable, and should I be worried? Whether CVE-2026-116582 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-116582 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-116582?
- Upgrade seroval to 1.6.10 or later
- Upgrade seroval to 1.0.0 or later

Other vulnerabilities in seroval

CVE-IDSeverityPackage summary

CVE-2026-116583Mediumseroval: Seroval: Code injection through a typed array's own constructor property CVE-2026-116581Highseroval: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)CVE-2026-116584Highseroval: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length CVE-2026-116580Highseroval: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check CVE-2026-104846Criticalseroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)