Zero Radar
← feed
HighVulnerabilityCVE-2026-116580updated 28 Oct 2026, 21:17 UTC

Seroval JavaScript library can run unintended code when reading untrusted data

Seroval is a library that turns JavaScript values into text and back. A crafted input could trick it into calling a function the app did not intend to run, which could expose or change data.

Fixed in seroval 1.6.8Official, 2 sources
SeverityHighCVSS 7.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesseroval 1.6.8 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts payloadReuses an identifier in the serialized data
  2. 2App calls fromJSONDeserializes untrusted input
  3. 3Plugin value selectedPlugin returns a callable or object with on()
  4. 4Plugin on() invokedDeserializer calls the plugin value's method
  5. ResultUnintended plugin code runs

What happened

Seroval up to 1.6.7 lets a crafted payload reuse an identifier so fromJSON calls the `on` method of a value returned by an application plugin during async iterator rebuilding; this is an incomplete fix for CVE-2026-59940.

Why it is dangerous: Applications that parse untrusted Seroval input with plugins that return callable values or objects with an `on` method can have those values invoked, with impact depending on what the plugin exposes.

Are you affected?

You are affected if your application uses seroval 1.6.7 or earlier to deserialize untrusted input with plugins that return functions or objects exposing an `on` method.

Package / productAffected versionsFixed in
seroval · npm<= 1.6.71.6.8

What to do

  1. Update seroval to 1.6.8 or later
  2. Until updated, avoid using plugins whose deserialize returns functions or objects with an `on` method when decoding untrusted input
  3. Review which plugins your application uses and what their deserialize functions return

Timeline

  1. 26 Oct 2026, 21:18 UTC
    Publicly disclosed
  2. 26 Oct 2026, 21:18 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 21:18 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:17 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:17 UTC
    Fixed version published: seroval 1.6.8 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116580 · GHSA-7rv5-mrxv-xcr9
CVSS
7.3 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 21:18 UTC
On Zero Radar
26 Oct 2026, 21:18 UTC (0 min after disclosure)
Last change
28 Oct 2026, 21:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Seroval JavaScript library can run unintended code when reading untrusted data · Zero Radar