CyberRota Analysis
AI-GeneratedThe vulnerability affects the Seroval library, specifically versions prior to 1.5.3, where the `seroval.fromJSON()` function improperly handles attacker-controlled JSON Promise nodes, leading to potential deserialization side effects. This flaw could allow for unintended server-side invocation or remote code execution, particularly when plugins are enabled and downstream frameworks interact with callable wrappers. Organizations using Seroval should prioritize upgrading to version 1.5.3 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.