CVE-2026-59940
Received Received - Intake

Seroval fromJSON Deserialization Side Effects in Plugins

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-59940
EUVD
EUVD-2026-60942

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lxsmnsyc seroval to 1.5.3 (exc)
lxsmnsyc seroval From 1.5.3 (exc)
seroval seroval 1.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a type confusion vulnerability in seroval.fromJSON() affecting versions <= 1.5.2. Attacker-controlled JSON input can manipulate Promise resolver nodes during deserialization, leading to unintended side effects. When plugins are enabled and return callable wrappers, this could enable server-side code execution or remote code execution if sensitive functionality is exposed.

Detection Guidance

Check if your system uses seroval versions <= 1.5.2 by inspecting package.json or running npm list seroval. Look for unexpected deserialization behavior or server-side code execution attempts in logs.

Impact Analysis

The vulnerability allows attackers to execute arbitrary code on the server if they can provide malicious JSON input. This could lead to full system compromise, data theft, or disruption of services. The impact is severe due to the lack of required privileges or user interaction for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade seroval to version 1.5.3 or later immediately. If using downstream frameworks with plugins, restrict node types, allowlist plugins, and avoid privileged plugins unless necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart