Seroval enables advanced JavaScript value stringification beyond standard JSON.stringify, but in versions 1.4.0 and earlier it improperly handles input during JSON deserialization. This flaw, a deserialization of untrusted data vulnerability (CWE‑502), allows an attacker to craft payloads that, when processed by the fromJSON or fromCrossJSON functions in a client‑to‑server context, can cause arbitrary JavaScript code to run. The vulnerability requires an attacker to execute four separate requests on the same deserialization function and requires partial knowledge of how the serialized data is later used; successful exploitation would grant the attacker full control over the environment, compromising confidentiality, integrity, and availability of the affected system.

The product affected is seroval provided by lxsmnsyc, with vulnerable releases equal to or older than version 1.4.0, used in Node.js applications that perform client‑to‑server transmissions with seroval's fromJSON and fromCrossJSON functions.

The CVSS score of 7.5 indicates high severity, but the EPSS score is reported as <1%, suggesting the likelihood of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog, and the attacker requires remote access, four staged requests, and knowledge of the serialization format, meaning that operational security controls such as authentication and request rate limiting could mitigate exploitation risk.