CVE-2026-116582
Description
A flaw was found in seroval. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) attacks by supplying crafted regular expression input to an application that serializes and embeds it into an HTML script element. Because the library fails to properly escape regular expression characters, the injected payload can break out of the script element and execute arbitrary JavaScript code within the context of the user's browser.
Statement
This vulnerability is evaluated with a Moderate severity rating because successful exploitation demands specific preconditions, specifically that untrusted input is converted into a regular expression and embedded directly within rendered HTML script tags. In typical Red Hat environments, application input handling and defensive template practices significantly constrain this exposure. Furthermore, an attack requires user interaction to execute cross-site script payloads in the victim's session, limiting the blast radius to client-side confidentiality and integrity impacts without server compromise.
Mitigation
Upgrade to seroval 1.6.10; or do not serialize untrusted RegExp (send source/flags as strings); or reject patterns containing '<'.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 4.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
