CVE-2026-104846

Name of the Vulnerable Software and Affected Versions Seroval versions 0.12.0 through 1.6.1

Description Seroval allows for the stringification of JavaScript values, including complex structures. A flaw in the fromJSON() deserialization process allows a fulfilled Promise control node to pass a plugin-produced thenable (an object with a then method) to a native Promise resolver. This leads to the unexpected invocation of the callable during ECMAScript thenable assimilation, enabling attacker-controlled JSON to trigger code execution in applications using plugin-capable releases. This behavior bypasses previous type-confusion remediations because the invocation occurs during native Promise settlement after deserialization.

Recommendations Update to version 1.6.2.