CVE-2026-23737: seroval Affected by Remote Code Execution via JSON Deserialization
Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.
The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing.
This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario.
No known workarounds or mitigations are known, so please upgrade to the patched version.
Other sources
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario. This issue has been fixed in version 1.4.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23737?
CVE-2026-23737 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-23737?
To fix CVE-2026-23737, update the seroval package to version 1.4.1 or later.
What kind of attacks can be performed using CVE-2026-23737?
CVE-2026-23737 can be exploited to execute arbitrary JavaScript code via remote code execution.
Which software versions are affected by CVE-2026-23737?
CVE-2026-23737 affects versions of the seroval package prior to 1.4.1.
How does CVE-2026-23737 impact application security?
CVE-2026-23737 compromises application security by allowing unauthorized code execution through vulnerabilities in JSON deserialization.