PT-2026-3878 · Seroval · Seroval

Lxsmnsyc + 1 · Published 2026-01-21 · Updated 2026-02-27 · CVE-2026-23736

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions seroval versions 1.4.0 and below

Description seroval provides JavaScript value stringification, handling complex structures beyond the capabilities of JSON.stringify. A flaw in input validation in versions 1.4.0 and below can lead to prototype pollution during JSON deserialization when processing malicious object keys. This issue specifically impacts the JSON deserialization functionality.

Recommendations Update to version 1.4.1 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-23736

GHSA-HJ76-42VX-JWP4

Affected Products

Seroval

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23736.json · Exploit
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Patch
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hj76-42vx-jwp4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hj76-42vx-jwp4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23736 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23736 · Vendor Advisory
• https://github.com/lxsmnsyc/seroval · Note
• https://t.me/cveNotify/153576 · Telegram Post
• https://t.me/cveNotify/149492 · Telegram Post
• https://twitter.com/CVEnew/status/2014116173932110161 · Twitter Post