Vulnerability details

CVE-2026-23737

lxsmnsyc seroval

seroval Affected by Remote Code Execution via JSON Deserialization

CVSS 3.1

7.5High

Official description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario. This issue has been fixed in version 1.4.0.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
lxsmnsyc	seroval	< 1.4.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3rxj-6cgf-8cfw x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-01-22
Last updated: 2026-01-23
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.58%

Probability of exploitation in 30 days

47.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-502
Deserialization of Untrusted Data