https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:33:03 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-59940 <p>Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.</p> <p>Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-59940 https://vulnerability.circl.lu/vuln/ghsa-mv8w-475r-vwqw <p><strong>Affected:</strong> npm: seroval</p> <p>## Summary</p> <p>A type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.</p> <p>In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.</p> <p>The issue was fixed in `seroval@1.5.3`.</p> <p>## Affected package</p> <p>- Package: `seroval` - Affected API: `fromJSON()` - Affected versions: versions prior to `1.5.3` that contain the vulnerable Promise resolver reference handling - Patched version: `1.5.3`</p> <p>## Impact</p> <p>The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval&#39;s internal promise resolver records.</p> <p>Direct impact in `seroval` is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization…</p> <p><strong>Affected:</strong> npm: seroval</p> <p>## Summary</p> <p>A type confusion issue in `seroval.fromJSON()` allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.</p> <p>In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.</p> <p>The issue was fixed in `seroval@1.5.3`.</p> <p>## Affected package</p> <p>- Package: `seroval` - Affected API: `fromJSON()` - Affected versions: versions prior to `1.5.3` that contain the vulnerable Promise resolver reference handling - Patched version: `1.5.3`</p> <p>## Impact</p> <p>The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval&#39;s internal promise resolver records.</p> <p>Direct impact in `seroval` is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization…</p> https://vulnerability.circl.lu/vuln/ghsa-mv8w-475r-vwqw https://vulnerability.circl.lu/vuln/opensuse-su-2026:11673-1 <p>opencode-1.18.26-1.1 on GA media</p> <p>opencode-1.18.26-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11673-1