Executive brief
seroval is a JavaScript library used to serialize and deserialize JavaScript values in web applications. A flaw in its JSON deserialization component allows an authenticated attacker to execute arbitrary JavaScript code on systems using affected versions. This could lead to data theft, session hijacking, or complete compromise of the application's security. Applications using seroval versions 1.4.0 and earlier are at risk and should upgrade immediately.
Technical details
The vulnerability exists in improper input validation (CWE-20) within seroval's JSON deserialization component. Specifically, the fromJSON and fromCrossJSON functions fail to properly validate deserialized data, allowing attackers to override constant values and manipulate error handling paths. This enables indirect access to unsafe JavaScript evaluation mechanisms. The attack requires: (1) authenticated access or ability to perform multiple requests to the same function, (2) high attack complexity, (3) partial knowledge of how serialized data is used at runtime, and (4) a client-to-server transmission scenario. An attacker can achieve confidentiality, integrity, and availability impact. The vulnerability is fixed in version 1.4.1 and later.
Affected products
- lxsmnsyc seroval <1.4.1
Timeline
- 2026-01-21: disclosed: Vulnerability published as GHSA-3rxj-6cgf-8cfw and CVE-2026-23737
- 2026-01-21: patched: Patched in version 1.4.1