npm · seroval
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.
In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.
The issue was fixed in seroval@1.5.3.
serovalfromJSON()1.5.3 that contain the vulnerable Promise resolver reference handling1.5.3The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval's internal promise resolver records.
Direct impact in seroval is a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization.
A concrete downstream impact scenario was validated privately against TanStack Start before the 1.5.3 fix. With seroval@1.5.3, the downstream reproducer no longer succeeds.
Upgrade to seroval@1.5.3 or later.
Downstream projects that accept Seroval JSON from untrusted clients should also consider defense-in-depth controls:
The original private reproducer was verified against seroval@1.5.2 and no longer reproduces against seroval@1.5.3.
Validation results:
seroval@1.5.2: vulnerable behavior reproduced.seroval@1.5.3: deserialization aborts before the attacker-controlled side effect occurs.seroval@1.5.3: no evidence side effect is produced.Reported by Mufeed VH from Winfunc Research.
The downstream TanStack Start impact was coordinated privately. Technical exploit details and proof-of-concept reproduction material have been omitted from this advisory draft for discretion.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.