Seroval versions 1.6.0 through 1.6.10 contain a vulnerability where typed arrays that have an own constructor property set from untrusted data can lead to code injection during serialization. This occurs because the constructor name is read from a mutable property on the typed array rather than its internal type, allowing arbitrary code to be serialized. The issue is fixed in version 1.6.11. The vulnerability requires unusual conditions where properties from untrusted objects are copied onto typed arrays.