Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

Source published

18 Aug 2026 14:34:28 UTC

Source modified

18 Aug 2026 15:49:59 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

Source published

Aug 18, 2026, 2:34:28 PM (timezone not stated)

Source modified

Aug 18, 2026, 3:49:59 PM (timezone not stated)

Observed here

7 Nov 2026 13:26:08 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

Source published

18 Aug 2026 15:16:56 UTC

Source modified

22 Oct 2026 22:10:00 UTC

Observed here

25 Oct 2026 14:19:22 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Summary A type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise. The issue was fixed in `[email protected]`. ## Affected package - Package: `seroval` - Affected API: `fromJSON()` - Affected versions: versions prior to `1.5.3` that contain the vulnerable Promise resolver reference handling - Patched version: `1.5.3` ## Impact The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval's internal promise resolver records. Direct impact in `seroval` is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization. A concrete downstream impact scenario was validated privately against TanStack Start before the `1.5.3` fix. With `[email protected]`, the downstream reproducer no longer succeeds. ## Remediation Upgrade to `[email protected]` or later. Downstream projects that accept Seroval JSON from untrusted clients should also consider defense-in-depth controls: - restrict accepted Seroval node types for client-to-server payloads; - allowlist plugin tags for inbound deserialization; - avoid registering plugins that produce callable or privileged values for untrusted inputs unless strictly necessary; - add regression tests ensuring deserialization cannot cause unintended server-side invocation as a side effect. ## Fix verification The original private reproducer was verified against `[email protected]` and no longer reproduces against `[email protected]`. Validation results: - `[email protected]`: vulnerable behavior reproduced. - `[email protected]`: deserialization aborts before the attacker-controlled side effect occurs. - TanStack Start downstream proof with `[email protected]`: no evidence side effect is produced. ## Credit Reported by [Mufeed VH](https://x.com/mufeedvh) from [Winfunc Research](https://winfunc.com). ## Disclosure / coordination note The downstream TanStack Start impact was coordinated privately. Technical exploit details and proof-of-concept reproduction material have been omitted from this advisory draft for discretion.

Source published

24 Jul 2026 16:14:05 UTC

Source modified

24 Jul 2026 16:33:10 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Publisher rating · CRITICAL