Seroval deserialization can invoke attacker-chosen callables
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Seroval before 1.6.8 rebuilds async iterator instances in fromJSON by calling source.on(listener) without checking that source is a genuine internal stream, which is CWE-502 deserialization of untrusted data. An unauthenticated remote attacker who supplies untrusted Seroval input can make the deserializer invoke a callable or on method that an application plugin returns, and the impact depends on what that plugin exposes. This is an incomplete fix for an earlier issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lxsmnsyc | seroval | before 1.6.8 | 1.6.8 | Patch available | CNA |
| — | seroval (npm) | before 1.6.8 | 1.6.8 | Patch available | GHSA-7rv5-mrxv-xcr9 |
- seroval Vendorlxsmnsyc Affected before 1.6.8 Fixed in 1.6.8 Patch available CNA
- seroval (npm) Vendor— Affected before 1.6.8 Fixed in 1.6.8 Patch available GHSA-7rv5-mrxv-xcr9
Remediation
Upgrade the npm package seroval to version 1.6.8. Red Hat rates this Important and lists Ansible Automation Orchestrator 2026 as affected with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA seroval (lxsmnsyc) Fixed in 1.6.8
- Fix · GHSA-7rv5-mrxv-xcr9 seroval (npm) Fixed in 1.6.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet |
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116580
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-27 CVSS score added · Red Hat
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-10-28 Alias added: GHSA-7rv5-mrxv-xcr9
- 2026-10-28 Fix available: npm/[email protected] · GHSA-7rv5-mrxv-xcr9
- 2026-10-28 CVSS score added · GHSA-7rv5-mrxv-xcr9
- 2026-10-28 Weakness changed · GHSA-7rv5-mrxv-xcr9
- 2026-10-28 6 new references · GHSA-7rv5-mrxv-xcr9
- 2026-11-02 CISA SSVC decision points changed
References
Other 5
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9
- https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2
- https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d
- https://github.com/lxsmnsyc/seroval/releases/tag/[email protected]
- https://github.com/lxsmnsyc/seroval
More lxsmnsyc vulnerabilities
- TI-2026-42747 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization CVSS 3.1CRITICAL 9.8
- TI-2026-66132 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) CVSS 3.1CRITICAL 9.8
- TI-2026-19109 seroval Affected by Prototype Pollution via JSON Deserialization CVSS 3.1CRITICAL 9.8
- TI-2026-19298 seroval affected by Denial of Service via RegExp serialization CVSS 3.1HIGH 7.5
- TI-2026-80920 Denial of service in Seroval fromJSON via unvalidated array length CVSS 3.1HIGH 7.5
- TI-2026-80917 Seroval fromJSON deserializer hangs on crafted sequence, causing DoS CVSS 3.1HIGH 7.5
Sources
- CVE-2026-116580 · CVE Program
- CVE-2026-116580 · NVD
- FIRST EPSS
- GHSA-7rv5-mrxv-xcr9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116580 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences