Arbitrary JavaScript Code Execution Vulnerability in Seroval by LXSMNSYC
CVE-2026-23737

7.5HIGH

Key Information:

Vendor

Lxsmnsyc

Status
Seroval
Vendor
CVE Published:
21 January 2026

What is CVE-2026-23737?

The Seroval library, utilized for JavaScript value stringification, is susceptible to arbitrary code execution due to improper input handling in its JSON deserialization process in versions 1.4.0 and earlier. This vulnerability stems from the exploitation of the fromJSON and fromCrossJSON functions, where attackers can manipulate the serialization mechanism to inject unsafe JavaScript code. For successful exploitation, it is necessary for the attacker to orchestrate several requests while having partial insight into the handling of serialized data during runtime. This creates a pathway for malicious code execution, ultimately compromising the application's integrity. An update to version 1.4.0 addresses this vulnerability effectively.

Affected Version(s)

seroval < 1.4.1

References

https://github.com/lxsmnsyc/seroval/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.