cve-2017-5941-poc-docker-lab

CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...

Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

EUVD-2026-110462

Seroval: Code injection through a typed array's own constructor property...

GHSA-F86P-H4J2-7QGJ Seroval: Code injection through a typed array's own constructor property

Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...

Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

EUVD-2026-110449

Seroval: Script injection through RegExp sources in serialized output...

GHSA-9WX9-5PV9-3349 Seroval: Script injection through RegExp sources in serialized output

Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...

RCE-NodeJs

node-serialize — CVE-2017-5941 Note: This document is for defense and educational purposes only. No instructions for creating exploits or RCE are included. Summary: node-serialize 0.0.4 and similar outdated versions may pose a risk due to untrusted deserialization — always validate input before...

SUSE CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CLSA-2026-1793125688 TuxCare security update for serialize-javascript (2 CVEs)

TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 7.1.1-tuxcare.2...

SUSE CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

SUSE CVE-2026-115897

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CLSA-2026-1793099227 TuxCare security update for serialize-javascript (2 CVEs)

TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 6.0.2-tuxcare.3...

CLSA-2026-1793098798 TuxCare security update for serialize-javascript (2 CVEs)

TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 7.1.2-tuxcare.1...

CVE-2026-116582

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...

CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-116583 Seroval: Code injection through a typed array's own constructor property

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-116583

The Seroval library (versions 1.6.0 through 1.6.11 ) contains a code injection vulnerability. The JavaScript-output APIs incorrectly derive a typed array's constructor name from a property that can be replaced by an own constructor property . If application code copies untrusted properties onto a...

CVE-2026-116582 Seroval: Script injection through RegExp sources in serialized output

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...