VulnerabilityReceived

CVE-2026-59940

Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side…

CRITICAL 9.8EPSS 0.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.61% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-502, CWE-843
Source: security-advisories@github.com

References

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.