Seroval CVE-2026-116582

Exploitation requires a specific integration: the downstream application must (1) construct a RegExp whose source is built from untrusted input used as regular-expression syntax (input run through an escapeRegExp-style helper is NOT sufficient to exploit), (2) serialize that RegExp with one of the JavaScript-output APIs - serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, the Serializer class, or compileJSON - and (3) embed the serialized output inside an HTML <script> element, as server-side rendering typically does. Limiting factors: the toJSON, fromJSON, toCrossJSON and fromCrossJSON APIs are NOT affected because they never emit JavaScript; a victim user must load the rendered page (UI:R); and only seroval versions before 1.0.0 and from 1.5.5 up to (not including) 1.6.10 are vulnerable. Applications that send RegExp source/flags as strings and rebuild on the client, or that reject patterns containing '<', are not exploitable.

This is a genuine but conditional XSS (CWE-79/CWE-116) in the seroval serialization library, and the signals point to low-to-moderate real-world priority rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) yields only 4.7 (Medium): network-reachable and unauthenticated, but with high attack complexity (the application must build a RegExp directly from untrusted pattern syntax and embed the serialized output in a script element) and required user interaction (a victim must load the rendered page). EPSS is low at 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit is identified in the input, which is consistent with a vulnerability that is only exploitable in a specific, non-default integration pattern rather than broadly. The vuln.today decision label is 'this_month', aligning with the picture of a real issue to patch on a normal cadence, not a drop-everything event. The signals are mutually consistent (low EPSS, no KEV, Medium CVSS, this_month) with no major conflicts; the main caveat is that exploitability depends entirely on how a downstream application uses the library, which the raw scores cannot capture.

A server-rendered application lets users supply a regular-expression pattern (for example a search filter), builds a RegExp from that raw input, serializes it with serialize/crossSerialize/compileJSON, and writes the result into an inline HTML <script> element. An attacker submits a pattern whose source contains '</script><script>...' so the unescaped '<' terminates the script element and injects attacker-controlled script that runs in the browser of any other user who views the rendered page. No public exploit is identified in the input, though the advisory and patch test cases illustrate the unsafe sources.