{"id":"EUVD-2026-91747","enisaUuid":"f1aa6654-d2bd-38c9-a7c0-e39e19360811","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","datePublished":"Oct 2, 2026, 3:59:45 PM","dateUpdated":"Oct 5, 2026, 8:10:22 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c\nhttps://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7\n","aliases":"CVE-2026-104846\nGHSA-p6vx-979v-rg4c\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"9ee78bc2-f112-3305-b7a8-691456ad575b","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"0.12.0, \u003c 1.6.2"}],"enisaIdVendor":[{"id":"d2047d52-7ff0-3d18-b036-54eb60da4965","vendor":{"name":"lxsmnsyc"}}],"enisaIdVulnerability":[{"id":"9ccdf4d1-29ff-3105-8af7-6149ba02de58","vulnerability":{"id":"CVE-2026-104846","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","datePublished":"Oct 2, 2026, 3:59:45 PM","dateUpdated":"Oct 5, 2026, 8:10:22 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c\nhttps://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7\n","enisa_id":"EUVD-2026-91747\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 2, 2026, 7:16:30 AM","vulnerabilityProduct":[{"id":"99c2601c-00a3-3159-8422-fd3732d8645b","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"0.12.0, \u003c 1.6.2"}],"vulnerabilityVendor":[{"id":"8bb0dc04-47fc-348d-aa53-59b158d27134","vendor":{"name":"lxsmnsyc"}}]}},{"id":"ec777b3c-6055-3805-8cea-f70f1698cf6c","vulnerability":{"id":"GHSA-p6vx-979v-rg4c","description":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)","datePublished":"Oct 5, 2026, 11:40:43 PM","dateUpdated":"Oct 5, 2026, 11:40:43 PM","baseScore":0.0,"references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104846\nhttps://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7\nhttps://github.com/lxsmnsyc/seroval\n","enisa_id":"EUVD-2026-91747\n","aliases":"GHSA-p6vx-979v-rg4c\nCVE-2026-104846\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}