Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-104846: Seroval versions before 1.6.2 let crafted JSON run code
CVE-2026-104846 · published 16 days ago
Summary
If you use Seroval (versions 0.12.0 through 1.6.2) to read JSON, an attacker can embed special data that causes your application to execute unwanted code when the JSON is parsed. This happens because the library incorrectly treats a promise-like object from a plug‑in as a normal promise and runs code it contains. Upgrade Seroval to version 1.6.2 or later to stop the issue.
What to do
- Update seroval to version 1.6.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | lxsmnsyc | seroval | >= 0.12.0, < 1.6.2 |
| npm | – | seroval |
>= 0.12.0, <= 1.6.0 >= 0.12.0, < 1.6.2 Fix: upgrade to 1.6.2
|
Original advisory text
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.
References
- https://github.com/lxsmnsyc/seroval Product
- https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e...
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c
- https://nvd.nist.gov/vuln/detail/CVE-2026-104846 Vendor Advisory
- https://github.com/advisories/GHSA-p6vx-979v-rg4c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1048... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-843Type Confusion
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-104846 · NVD
CVE-2026-104846 · MITRE
GHSA-p6vx-979v-rg4c · GHSA
CVE-2026-104846 · OSV
GHSA-p6vx-979v-rg4c · OSV
Track software like this
Free during beta