VULNERABILITY INTELLIGENCE

CVE-2026-23736

CVSS score7.3 HIGH
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-01-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.

Weakness classification

  • security-advisories@github.com: CWE-1321

Primary references