Description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:16:56.007Z",
  "pubdate": "2026-08-18T15:16:56.007Z",
  "executiveSummary": "A vulnerability exists in the seroval library prior to version 1.5.3, specifically involving the seroval.fromJSON() function. The flaw allows attacker-controlled JSON Promise control nodes to interact with values residing in the general deserialization reference table without performing validation checks for genuine internal Promise resolver records. This insecure handling triggers unintended deserialization side effects when plugins are enabled.\nThe primary impact of this vulnerability includes potential unintended server-side invocation and remote code execution (RCE). These outcomes become possible when downstream frameworks register callable wrappers that interact with the manipulated execution flow. Attackers require the capability to supply controlled JSON inputs to the deserialization routine.\nAffected systems include deployments utilizing seroval versions before 1.5.3. The risk implication is severe, as successful exploitation can lead to complete compromise of the underlying application environment depending on the capabilities exposed by downstream framework integrations and active plugins.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient validation of Promise control nodes within seroval.fromJSON(). During the deserialization process, seroval reconstructs complex JavaScript values from serialized representations using a general reference table. Prior to version 1.5.3, the parser processes attacker-supplied JSON Promise control nodes without verifying whether they correspond to authentic internal Promise resolver records.\nWhen plugins are enabled, this lack of validation permits malicious payloads to operate directly on arbitrary values stored within the deserialization reference table. The attack flow begins with an attacker crafting a malicious JSON payload containing fraudulent Promise control nodes. When the target application passes this payload to seroval.fromJSON(), the library evaluates the nodes under the assumption that they are legitimate asynchronous control structures.\nBecause the validation of internal resolver records is bypassed, the execution engine processes the manipulated nodes in a way that generates unintended side effects. If downstream frameworks have registered callable wrappers or exposed methods that intersect with these deserialization side effects, the attacker can leverage this behavior to achieve unintended server-side invocation or escalate the condition to remote code execution.\nThe vulnerable component is the seroval.fromJSON() function and its associated Promise handling logic within seroval versions prior to 1.5.3. Exploitation relies on the presence of specific plugins and downstream framework integrations that provide callable wrappers. Network exposure depends on how the application ingests untrusted JSON data into the seroval deserialization pipeline."
}