CVE-2026-23736 — seroval Affected by Prototype Pollution via JSON Deserialization
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a m…
Published: 2026-01-21 · CVSS: 7.3 · CVSS 3.1
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7