CVE-2026-104846 in Seroval
Summary
by MITRE • 10/02/2026
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified as Seroval versions prior to 1.6.2 involves a critical flaw in the serialization and deserialization logic, specifically within the handling of JavaScript Promise objects during fromJSON operations. Seroval is designed to facilitate JS value stringification with capabilities that extend beyond standard JSON.stringify limitations, allowing for the preservation of complex structures such as functions and circular references through plugin mechanisms. However, this extended functionality introduces a significant security risk when deserializing data containing fulfilled Promises. The core technical flaw lies in how the library processes control nodes associated with these promises during the reconstruction phase. When a fromJSON operation encounters a serialized Promise that is already resolved or rejected, it attempts to reconstruct the state by invoking native JavaScript APIs rather than simply setting internal properties.
The specific mechanism of exploitation involves the assimilation of thenable objects into native Promises. A plugin-produced callable-bearing thenable can be embedded within the attacker-controlled JSON payload. During deserialization, this thenable is passed directly to a native Promise resolver. According to ECMAScript specifications, when a non-Promise value with a then method is provided to a Promise constructor or resolver, the engine attempts to assimilate it by calling its then method synchronously if possible. In this vulnerable scenario, the library inadvertently triggers this callable without sufficient validation of its origin or safety. This results in an unexpected invocation of attacker-controlled code within the context of the application using Seroval. The attack vector relies on the victim processing untrusted JSON data that has been crafted to include these malicious thenable structures, effectively turning a deserialization routine into a remote code execution pathway.
This vulnerability represents a type confusion and improper input validation issue where user-supplied data influences control flow in an unsafe manner. It is particularly severe because it bypasses previous remediation efforts aimed at similar issues. Specifically, CVE-2026-59940 addressed a Promise resolver type-confusion problem in version 1.5.3 by restricting how resolvers handle certain inputs. However, the flaw described here circumvents that fix because the unexpected invocation occurs through native Promise settlement after the referenced value has already been deserialized and processed as part of the object graph reconstruction. The security boundary assumed by the previous patch does not account for this specific path where a thenable is passed to the resolver during the assimilation phase, leading to code execution before any additional safety checks might be applied.
From an industry standards perspective, this vulnerability aligns with CWE-502 Deserialization of Untrusted Data and CWE-94 Improper Control of Generation of Code or Script. The exploitation technique leverages ATT&CK T1059 Command and Scripting Interpreter by using JavaScript execution to achieve arbitrary code execution within the application environment. The impact is severe, as it allows an attacker who can supply JSON input to execute arbitrary functions in the context of the vulnerable application. This could lead to full system compromise depending on the privileges of the running process, data exfiltration, or further lateral movement if the compromised application has access to sensitive resources.
Mitigation for this vulnerability requires immediate upgrading to Seroval version 1.6.2 or later, where the issue is resolved by properly validating and sanitizing thenable objects during deserialization. Applications relying on Seroval should also implement strict input validation policies, ensuring that only expected data types are processed through serialization libraries. Additionally, developers should avoid using fromJSON with untrusted sources unless absolutely necessary, and if such usage is required, they must ensure the integrity of the JSON payload via digital signatures or other authentication mechanisms to prevent tampering by attackers. Regular security audits of third-party library dependencies are essential to identify and address similar deserialization risks in modern JavaScript ecosystems.