CVE-2026-23736highCWE-1321

CVE-2026-23736: falha de alta gravidade em lxsmnsyc seroval

seroval Affected by Prototype Pollution via JSON Deserialization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar seroval+ Monitorar seroval

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.3%
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
lxsmnsyc · seroval
CVEs relacionadas — lxsmnsyc seroval

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.8%CVE-2026-23737HIGHseroval Affected by Remote Code Execution via JSON DeserializationEPSS 0.6%CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2026-116581HIGHSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)EPSS 0.5%CVE-2026-24006HIGHSeroval affected by Denial of Service via Deeply Nested ObjectsEPSS 0.4%CVE-2026-23957HIGHseroval is vulnerable to Denial of Service via array serializationEPSS 0.4%