seroval Affected by Remote Code Execution via JSON Deserialization

Description

Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.

The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation.

Recommendation

Update the seroval package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-3rxj-6cgf-8cfw
• CVE-2026-23737
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
• Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
• FUXA Unauthenticated Remote Code Execution via Admin JWT Minting - CVE-2026-25893
• FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration - CVE-2026-25894

Tags:

npm

seroval