GHSA-9wx9-5pv9-3349 Seroval: Script injection through RegExp sources in serialized output

• npm seroval: >= 1.5.5, < 1.6.10 → fixed in 1.6.10 • npm seroval: < 1.0.0 → fixed in 1.0.0

Summary seroval writes a `RegExp` as a regular expression literal. In affected versions, the `` element that the serialized output is placed in, and run script in the page. Details seroval escapes `` element. `RegExp` sources did not get the same escaping: • Versions before 1.0.0 wrote the source as is. • Version 1.5.5 stopped escaping `` element, as server rendering usually does. In that case an attacker can run script in the page of any user who receives that output. Patches Fixed in 1.6.10. A `RegExp` whose source contains `<` is now written with the `RegExp` constructor and an escaped string source. Named groups and lookbehinds keep working. Workarounds If you cannot upgrade: • Do not serialize a `RegExp` built from untrusted pattern syntax. Send its source and flags as strings, and build the `RegExp` on the client. • Or reject patterns that contain `<` before they reach the serializer.