Listen to this Post
The vulnerability in seroval arises from insecure JSON deserialization in the `fromJSON` and `fromCrossJSON` functions. During deserialization, the library improperly handles input, allowing constant values to be overridden and errors to be deserialized maliciously. This provides indirect access to unsafe JavaScript evaluation mechanisms. An attacker can exploit this by crafting specific JSON payloads and sending them in a client-to-server scenario. The exploitation requires at least four separate requests to the same function, with partial knowledge of how the deserialized data is processed during runtime. Each request manipulates the deserialization state, gradually building a chain that triggers arbitrary code execution. By overriding constants, the attacker can alter program flow, and through error deserialization, they can induce conditions that evaluate injected JavaScript. This flaw enables remote code execution on the server or client, depending on the transmission context, posing a high risk due to potential full application compromise.
DailyCVE Form:
Platform: seroval
Version: Versions before patched
Vulnerability: JSON Deserialization RCE
Severity: High
date: Jan 21 2026
Prediction: Patched Jan 2026
What Undercode Say:
Analytics
npm list seroval npm update seroval
import { fromJSON } from 'seroval';
const data = fromJSON(maliciousPayload);
How Exploit:
Craft JSON payloads overriding constants and errors, send via multiple requests to `fromJSON` or `fromCrossJSON` for RCE.
Protection from this CVE:
Upgrade seroval library.
Impact:
Remote Code Execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
