{"id":"CVE-2026-104846","aliases":["CLSA-2026-1791973750","CLSA-2026-1792286818","EUVD-2026-91747","GHSA-p6vx-979v-rg4c"],"status":"published","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00345,"percentile":0.28511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-10-02T15:59:45Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"npm","package":"seroval","fixed_in":["1.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"seroval","fixed_in":["1.5.6-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"seroval-plugins","fixed_in":["1.5.6-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"seroval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"last_affected":"1.6.0"},{"fixed":"1.6.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"seroval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.6-tuxcare.0"},{"fixed":"1.5.6-tuxcare.2"}]}],"versions":["1.5.6","1.5.6-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"seroval-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.6-tuxcare.0"},{"fixed":"1.5.6-tuxcare.2"}]}],"versions":["1.5.6","1.5.6-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"seroval","ranges":[{"type":"SEMVER","events":[{"introduced":"0.12.0"},{"fixed":"1.6.2"}]}]}],"products":[{"vendor":"lxsmnsyc","product":"seroval"}],"references":[{"url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104846","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p6vx-979v-rg4c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104846.json","tags":["advisory"]},{"url":"https://github.com/lxsmnsyc/seroval","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-104846","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","status":"published","published":"2026-10-02T15:59:45.802Z","modified":"2026-10-05T20:10:22.499Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-91747","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","status":"published","published":"2026-10-02T15:59:45Z","modified":"2026-10-05T20:10:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:39.05741Z"}],"ghsa":[{"id":"GHSA-p6vx-979v-rg4c","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)","description":"A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in `seroval@1.5.3` (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from `0.12.0` through the current `1.6.0`.","status":"published","published":"2026-10-05T23:40:43Z","modified":"2026-10-05T23:40:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-104846","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","status":"published","published":"2026-10-02T16:16:47.23Z","modified":"2026-10-05T21:16:32.78Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-104846","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","status":"published","published":"2026-10-02T15:59:45.802Z","modified":"2026-10-28T02:30:49.061065357Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"GHSA-p6vx-979v-rg4c","title":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)","description":"A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in `seroval@1.5.3` (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from `0.12.0` through the current `1.6.0`.","status":"published","published":"2026-10-05T23:40:43Z","modified":"2026-10-06T00:00:08.435171324Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"CLSA-2026-1791973750","title":"TuxCare security update for seroval (1 CVE)","description":"TuxCare rebuilt seroval to address 1 CVE. Fixed in 1.5.6-tuxcare.2.","status":"published","published":"2026-10-14T10:29:10Z","modified":"2026-10-18T07:15:06.122286226Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792286818","title":"TuxCare security update for seroval-plugins (1 CVE)","description":"TuxCare rebuilt seroval-plugins to address 1 CVE. Fixed in 1.5.6-tuxcare.2.","status":"published","published":"2026-10-18T01:26:57Z","modified":"2026-10-18T07:15:02.815065168Z","updated_at":"2026-11-02T15:43:52.288832Z"}]}}