GitHub Advisoryadvisory · npm

GHSA-3rxj-6cgf-8cfw seroval Affected by Remote Code Execution via JSON Deserialization

HIGH Published 2026-01-21 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-23737
Ecosystem
npm
Packages
seroval
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2026-01-21

Affected packages

• npm seroval: < 1.4.1 → fixed in 1.4.1

Description

Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the `fromJSON` and `fromCrossJSON` functions in a client-to-server transmission scenario. No known workarounds or mitigations are known, so please upgrade to the patched version.

Related

Alias · CVE (1)

  • CVE-2026-23737 seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References