lxsmnsyc seroval up to 1.4.0 deserialization

Summaryinfo

A vulnerability classified as problematic has been found in lxsmnsyc seroval up to 1.4.0. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in deserialization. This vulnerability was named CVE-2026-23737. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in lxsmnsyc seroval up to 1.4.0. This affects some unknown processing. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario. This issue has been fixed in version 1.4.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-23737 since 01/15/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.4.1 eliminates this vulnerability. Applying the patch ce9408ebc87312fcad345a73c172212f2a798060 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3679). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• lxsmnsyc

Name

• seroval

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• open-source

Website

• Product: https://github.com/lxsmnsyc/seroval/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion