Seroval EUVD-2026-110462

Exploitation requires a specific, non-default application pattern: code that copies untrusted own properties - specifically an own constructor property whose .name is attacker-controlled - onto a typed array, and then passes that array to one of the affected JavaScript-output APIs (serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, the Serializer class, or compileJSON) in seroval 1.6.0 through 1.6.10. Limiting factors: the vendor calls this property-copying pattern 'unusual'; fromJSON and fromCrossJSON are not affected because they only accept built-in typed-array names; the compactArrayBufferViews option throws a TypeError instead of emitting code; and a victim must load the page that receives the serialized output (UI:P) for the injected script to run.

This is a genuinely low-to-moderate-priority issue despite the 'script execution' outcome, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P) describes a network-reachable but hard-to-reach flaw: the AC:H and AT:P metrics reflect the vendor's own statement that exploitation requires an unusual application coding pattern, and UI:P requires a victim to load the page that receives the serialized output. EPSS is low at 0.27% (19th percentile), SSVC reports Exploitation: none / Automatable: no / Technical Impact: partial, and the issue is not in CISA KEV - all of which agree with the vendor's self-assessed Low severity. The vuln.today decision label is 'this_month', i.e. patch on a normal cadence, not an emergency. The only upward signal is the qualitative impact (arbitrary JavaScript in the receiving page), but it is gated behind a precondition the vendor explicitly calls 'unusual' (application code copying untrusted own properties, including a constructor property, onto a typed array before serializing). Note one internal tension to verify: the input CVSS 4.0 rates subsequent-system impact as SC:H/SI:H, which is higher than the overall 5.3 Medium score and the vendor's Low rating would suggest - the high subsequent-impact metrics reflect worst-case script execution, not likelihood.

An application copies attacker-controlled properties from an untrusted object onto a typed array (setting its own constructor property), then serializes that array with seroval's serialize/crossSerialize/compileJSON output to the page. Because the pre-1.6.11 code reads the constructor name from the value's own property rather than the array's real type, the attacker's string is emitted verbatim as executable JavaScript and runs in the browser that receives the output. No weaponized standalone exploit is identified, though the fix commit includes test cases (e.g. payloads like alert(1)// and </script>) that demonstrate the injection technique.