GHSA-3rxj-6cgf-8cfw
seroval Affected by Remote Code Execution via JSON Deserialization
Quick fix
GHSA-3rxj-6cgf-8cfw — seroval: upgrade to the fixed version with the command below.
npm install seroval@1.4.1Details
Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.
The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing.
This vulnerability affects the `fromJSON` and `fromCrossJSON` functions in a client-to-server transmission scenario.
No known workarounds or mitigations are known, so please upgrade to the patched version.
Are you affected?
Enter the version of the package you're using.