Seroval: Code injection through a typed array's own constructor property

[ Description ]Official description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

[ Fixes ]Fixes and patches

• seroval 1.6.11Fixed version · GitHub Advisories · npm package seroval: upgrade to 1.6.11 or later (affected >= 1.6.0, < 1.6.11)

[ Packages ]Affected open-source packages

• seroval npmAffected >= 1.6.0, < 1.6.11 · fixed in 1.6.11 · GHSA-f86p-h4j2-7qgj

[ References ]References

• github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
• github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11
• github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj