high7.5
CVE-2026-23737
seroval Affected by Remote Code Execution via JSON Deserialization
Impact
Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the `fromJSON` and `fromCrossJSON` functions in a client-to-server transmission scenario. No known workarounds or mitigations are known, so please upgrade to the patched version.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | seroval | < 1.4.1 | 1.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lxsmnsyc | Seroval | before 1.4.1 |