{"id":"CVE-2026-104846","published":"2026-10-02T16:16:47.230","lastModified":"2026-10-05T21:16:32.780","description":"Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-843"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c","tags":[]}],"exploitRefs":[{"url":"https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7","tags":[]},{"url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw allows attacker-controlled JSON to execute arbitrary code by deserializing a fulfilled Promise control node, which invokes a callable unexpectedly.","exploitability":"Exploitation is moderately hard as it requires the deserialization of a specific type of JSON payload, and the target application must be using a vulnerable version of Seroval.","blast_radius":"If exploited, this could lead to full code execution in the context of the application, potentially compromising the entire system.","remediation":"Upgrade to Seroval version 1.6.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","json-deserialization","promise","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:45:08.068Z"}}