{"id":"CVE-2026-104846","revision":"4c73e9ab50cc4e3a93b8355c1d16e9e2","records":[{"revision":"4c73e9ab50cc4e3a93b8355c1d16e9e2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104846","aliases":[],"title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","state":0,"publishedAt":"2026-10-02T15:59:45.802+00:00","modifiedAt":"2026-10-05T20:10:22.499+00:00","affected":[{"ecosystem":"Vendor product","name":"seroval","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lxsmnsyc\",\n                    \"product\": \"seroval\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.12.0, < 1.6.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c","https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104846","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104846","identifiers":["CVE-2026-104846"]},"retained":false,"historicalAffected":[]}],"coverage":[]}