Bug 2431898 (CVE-2026-23736)

Summary: CVE-2026-23736 seroval: seroval: Prototype pollution via improper input validation during JSON deserialization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in seroval. Due to improper input validation during JSON deserialization, a remote attacker could provide a malicious object key. This could lead to prototype pollution, potentially allowing the attacker to alter the behavior of the application or disclose sensitive information. This vulnerability specifically affects the JSON deserialization functionality.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2431947, 2431951, 2431954    
Bug Blocks:    

Description OSIDB Bzimport 2026-01-22 00:09:09 UTC
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.