[rigelbuild-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
seroval (source)	1.6.9 → 1.6.11

---

Seroval: Script injection through RegExp sources in serialized output

CVE-2026-116582 / GHSA-9wx9-5pv9-3349

More information

Details

Summary

seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.

Details

seroval escapes < in strings, so string values cannot end a <script> element. RegExp sources did not get the same escaping:

• Versions before 1.0.0 wrote the source as is.
• Version 1.5.5 stopped escaping < in RegExp sources, so that named groups and lookbehinds keep working. This removed the escaping for every < in a source.

These functions are affected:

• serialize, serializeAsync
• crossSerialize, crossSerializeAsync, crossSerializeStream
• the Serializer class
• compileJSON

toJSON, fromJSON, toCrossJSON and fromCrossJSON are not affected, because they never produce JavaScript.

Impact

An application is affected when all of these are true:

1. It builds a RegExp from untrusted input that is used as regular expression syntax. Input passed through an escaping helper (such as an escapeRegExp function) is not enough to exploit this.
2. It serializes that RegExp with one of the functions above.
3. It places the output inside an HTML <script> element, as server rendering usually does.

In that case an attacker can run script in the page of any user who receives that output.

Patches

Fixed in 1.6.10. A RegExp whose source contains < is now written with the RegExp constructor and an escaped string source. Named groups and lookbehinds keep working.

Workarounds

If you cannot upgrade:

• Do not serialize a RegExp built from untrusted pattern syntax. Send its source and flags as strings, and build the RegExp on the client.
• Or reject patterns that contain < before they reach the serializer.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349
• https://nvd.nist.gov/vuln/detail/CVE-2026-116582
• https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6
• https://github.com/lxsmnsyc/seroval
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583 / GHSA-f86p-h4j2-7qgj

More information

Details

Summary

seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.

Details

Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own constructor property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array's real type.

These functions are affected:

• serialize, serializeAsync
• crossSerialize, crossSerializeAsync, crossSerializeStream
• the Serializer class
• compileJSON

fromJSON and fromCrossJSON are not affected: they only accept the names of the built-in typed arrays. With the compactArrayBufferViews option, the same lookup throws a TypeError instead of writing code.

Impact

An application is affected only when it serializes a typed array that has an own constructor property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.

Patches

Fixed in 1.6.11. The constructor name now comes from the array's internal type, which properties on the value cannot change. compactArrayBufferViews uses the real type as well.

Workarounds

If you cannot upgrade, do not copy properties from untrusted objects onto typed arrays, or remove an own constructor property from a typed array before serializing it.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-116583
• https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
• https://github.com/lxsmnsyc/seroval
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

lxsmnsyc/seroval (seroval)

v1.6.11

Compare Source

v1.6.10

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

Compass engineering docs preview: https://renovate-npm-seroval-vulnera.compass-eng-docs.pages.dev

Deployed from renovate/npm-seroval-vulnerability at 92dd0d0.

[rigel-mintaka]

Closing: Compass is superseded by Rigel Factory (Matt, 2026-10-30).