https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 23:16:39 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116583 <p>Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array&#39;s constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.</p> <p>Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array&#39;s constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116583 https://db.gcve.eu/vuln/ghsa-f86p-h4j2-7qgj <p><strong>Affected:</strong> npm: seroval</p> <p>### Summary</p> <p>seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.</p> <p>### Details</p> <p>Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own `constructor` property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array&#39;s real type.</p> <p>These functions are affected:</p> <p>- `serialize`, `serializeAsync` - `crossSerialize`, `crossSerializeAsync`, `crossSerializeStream` - the `Serializer` class - `compileJSON`</p> <p>`fromJSON` and `fromCrossJSON` are not affected: they only accept the names of the built-in typed arrays. With the `compactArrayBufferViews` option, the same lookup throws a `TypeError` instead of writing code.</p> <p>### Impact</p> <p>An application is affected only when it serializes a typed array that has an own `constructor` property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.</p> <p>### Patches</p> <p>Fixed in 1.6.11. The constructor name now comes from the array&#39;s internal type, which properties on the…</p> <p><strong>Affected:</strong> npm: seroval</p> <p>### Summary</p> <p>seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.</p> <p>### Details</p> <p>Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own `constructor` property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array&#39;s real type.</p> <p>These functions are affected:</p> <p>- `serialize`, `serializeAsync` - `crossSerialize`, `crossSerializeAsync`, `crossSerializeStream` - the `Serializer` class - `compileJSON`</p> <p>`fromJSON` and `fromCrossJSON` are not affected: they only accept the names of the built-in typed arrays. With the `compactArrayBufferViews` option, the same lookup throws a `TypeError` instead of writing code.</p> <p>### Impact</p> <p>An application is affected only when it serializes a typed array that has an own `constructor` property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.</p> <p>### Patches</p> <p>Fixed in 1.6.11. The constructor name now comes from the array&#39;s internal type, which properties on the…</p> https://db.gcve.eu/vuln/ghsa-f86p-h4j2-7qgj