7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23736

CVE-2026-23736: seroval Affected by Prototype Pollution via JSON Deserialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23736

CVE-2026-23736:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
seroval	npm	< 1.4.1	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic prototype pollution issue within the seroval library's JSON deserialization process. The root cause lies in the deserializeProperties function, which, prior to the patch, would directly assign properties to a newly created object without any validation of the property keys. An attacker could craft a JSON payload containing a __proto__ key to modify the Object.prototype of the running application. This could lead to various consequences, including denial of service, or potentially remote code execution in some contexts.

The patch addresses this by introducing a new function, isValidKey, which explicitly checks for and disallows malicious keys like __proto__, constructor, and prototype. The deserializeProperties function was refactored to use a new assignProperty function, which in turn uses isValidKey to ensure that only safe properties are assigned to the deserialized object. The primary vulnerable function is deserializeProperties, as it contained the unsafe property assignment logic. The functions deserializeObject and the public API fromJSON are also relevant as they are part of the call stack that leads to the vulnerable code path during exploitation.

Vulnerable functions

deserializeProperties

packages/seroval/src/core/context/deserializer.ts

This internal function is responsible for assigning properties to a newly created object during deserialization. The vulnerability lies in the direct assignment `result[deserializeString(key)] = deserialize(ctx, vals[i]);` without validating the `key`. A malicious key such as `__proto__` could be used to pollute the object's prototype.

deserializeObject

packages/seroval/src/core/context/deserializer.ts

This function orchestrates the creation of a plain JavaScript object from a Seroval node. It calls the vulnerable `deserializeProperties` function to populate the object, making it part of the exploitation chain.

fromJSON

packages/seroval/src/core/tree/index.ts

This is the main public-facing API for deserializing a JSON object. While not directly containing the vulnerable code, it is the entry point for an attacker to supply a malicious payload that triggers the prototype pollution vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.