CVE-2026-59940

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Seroval facilita la conversión a cadena de valores JS, incluyendo estructuras complejas que van más allá de las capacidades de JSON.stringify. Antes de la versión 1.5.3, seroval.fromJSON() permite que nodos de control de Promise JSON controlados por el atacante operen sobre valores de la tabla de referencia general de deserialización sin verificar los registros genuinos del resolvedor interno de Promise, causando efectos secundarios de deserialización con los plugins habilitados y una invocación no intencionada del lado del servidor o ejecución remota de código cuando los frameworks descendentes registran envoltorios invocables. Este problema está solucionado en la versión 1.5.3.

Information

Published : 2026-08-18 15:16

Updated : 2026-10-22 22:10

NVD link : CVE-2026-59940

Mitre link : CVE-2026-59940

CVE.ORG link : CVE-2026-59940

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2026-59940", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59940", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T15:49:53.645084Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxsmnsyc", "product": "seroval", "versions": [{"status": "affected", "version": "< 1.5.3"}]}]}], "published": "2026-08-18T15:16:56.007", "references": [{"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3."}, {"lang": "es", "value": "Seroval facilita la conversi\u00f3n a cadena de valores JS, incluyendo estructuras complejas que van m\u00e1s all\u00e1 de las capacidades de JSON.stringify. Antes de la versi\u00f3n 1.5.3, seroval.fromJSON() permite que nodos de control de Promise JSON controlados por el atacante operen sobre valores de la tabla de referencia general de deserializaci\u00f3n sin verificar los registros genuinos del resolvedor interno de Promise, causando efectos secundarios de deserializaci\u00f3n con los plugins habilitados y una invocaci\u00f3n no intencionada del lado del servidor o ejecuci\u00f3n remota de c\u00f3digo cuando los frameworks descendentes registran envoltorios invocables. Este problema est\u00e1 solucionado en la versi\u00f3n 1.5.3."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}