VDB
CVE-2026-23736
CVE-2026-23736
PUBLISHED
CVSS 7.300000190734863 HIGH
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.
EPSS 0.29% · 22.1th percentile
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.29%
22.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| lxsmnsyc | seroval | < 1.4.1, 0, < 1.4.1 |
| npm | seroval | 0, 0 |
Timeline
- Jan 21, 2026 CVE Published
- Jan 22, 2026 CVE Updated
- Jan 22, 2026 EPSS Score
- Jan 22, 2026 PoC Published
- Jan 25, 2026 EPSS Score
- Jan 28, 2026 EPSS Score
- Jan 30, 2026 Security Advisory
- Jan 31, 2026 EPSS Score
- Feb 3, 2026 EPSS Score
- Feb 6, 2026 EPSS Score
- Feb 9, 2026 EPSS Score
- Feb 12, 2026 EPSS Score