seroval Affected by Remote Code Execution via JSON Deserialization

Description

Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.

The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation.

Recommendation

Update the seroval package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-3rxj-6cgf-8cfw
• CVE-2026-23737
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
• OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900
• Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step - CVE-2026-35216
• FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API - CVE-2026-25895

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

seroval