GHSA-MV8W-475R-VWQW
Vulnerability from github – Published: 2026-07-24 16:14 – Updated: 2026-07-24 16:14Summary
A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.
In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.
The issue was fixed in seroval@1.5.3.
Affected package
- Package:
seroval - Affected API:
fromJSON() - Affected versions: versions prior to
1.5.3that contain the vulnerable Promise resolver reference handling - Patched version:
1.5.3
Impact
The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval's internal promise resolver records.
Direct impact in seroval is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization.
A concrete downstream impact scenario was validated privately against TanStack Start before the 1.5.3 fix. With seroval@1.5.3, the downstream reproducer no longer succeeds.
Remediation
Upgrade to seroval@1.5.3 or later.
Downstream projects that accept Seroval JSON from untrusted clients should also consider defense-in-depth controls:
- restrict accepted Seroval node types for client-to-server payloads;
- allowlist plugin tags for inbound deserialization;
- avoid registering plugins that produce callable or privileged values for untrusted inputs unless strictly necessary;
- add regression tests ensuring deserialization cannot cause unintended server-side invocation as a side effect.
Fix verification
The original private reproducer was verified against seroval@1.5.2 and no longer reproduces against seroval@1.5.3.
Validation results:
seroval@1.5.2: vulnerable behavior reproduced.seroval@1.5.3: deserialization aborts before the attacker-controlled side effect occurs.- TanStack Start downstream proof with
seroval@1.5.3: no evidence side effect is produced.
Credit
Reported by Mufeed VH from Winfunc Research.
Disclosure / coordination note
The downstream TanStack Start impact was coordinated privately. Technical exploit details and proof-of-concept reproduction material have been omitted from this advisory draft for discretion.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.5.2"
},
"package": {
"ecosystem": "npm",
"name": "seroval"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59940"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-843"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T16:14:05Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Summary\n\nA type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.\n\nIn applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.\n\nThe issue was fixed in `seroval@1.5.3`.\n\n## Affected package\n\n- Package: `seroval`\n- Affected API: `fromJSON()`\n- Affected versions: versions prior to `1.5.3` that contain the vulnerable Promise resolver reference handling\n- Patched version: `1.5.3`\n\n## Impact\n\nThe vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval\u0027s internal promise resolver records.\n\nDirect impact in `seroval` is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization.\n\nA concrete downstream impact scenario was validated privately against TanStack Start before the `1.5.3` fix. With `seroval@1.5.3`, the downstream reproducer no longer succeeds.\n\n## Remediation\n\nUpgrade to `seroval@1.5.3` or later.\n\nDownstream projects that accept Seroval JSON from untrusted clients should also consider defense-in-depth controls:\n\n- restrict accepted Seroval node types for client-to-server payloads;\n- allowlist plugin tags for inbound deserialization;\n- avoid registering plugins that produce callable or privileged values for untrusted inputs unless strictly necessary;\n- add regression tests ensuring deserialization cannot cause unintended server-side invocation as a side effect.\n\n## Fix verification\n\nThe original private reproducer was verified against `seroval@1.5.2` and no longer reproduces against `seroval@1.5.3`.\n\nValidation results:\n\n- `seroval@1.5.2`: vulnerable behavior reproduced.\n- `seroval@1.5.3`: deserialization aborts before the attacker-controlled side effect occurs.\n- TanStack Start downstream proof with `seroval@1.5.3`: no evidence side effect is produced.\n\n## Credit\n\nReported by [Mufeed VH](https://x.com/mufeedvh) from [Winfunc Research](https://winfunc.com).\n\n## Disclosure / coordination note\n\nThe downstream TanStack Start impact was coordinated privately. Technical exploit details and proof-of-concept reproduction material have been omitted from this advisory draft for discretion.",
"id": "GHSA-mv8w-475r-vwqw",
"modified": "2026-07-24T16:14:06Z",
"published": "2026-07-24T16:14:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxsmnsyc/seroval"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/seroval/v/1.5.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.