SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-59940

CRITICAL · CVSS 9.8 EPSS 0.61% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-18 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects the Seroval library, specifically versions prior to 1.5.3, where the `seroval.fromJSON()` function improperly handles attacker-controlled JSON Promise nodes, leading to potential deserialization side effects. This flaw could allow for unintended server-side invocation or remote code execution, particularly when plugins are enabled and downstream frameworks interact with callable wrappers. Organizations using Seroval should prioritize upgrading to version 1.5.3 to mitigate this critical risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-59940
Severity
CRITICAL
CVSS
9.8
EPSS
0.61%

Original NVD Description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.