{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/seroval-versions-prior-to-1.5.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["seroval (versions prior to 1.5.3)","TanStack Start"],"_cs_severities":["critical"],"_cs_tags":["type-confusion","deserialization","rce","npm","ghsa"],"_cs_type":"advisory","_cs_vendors":["TanStack"],"content_html":"\u003cp\u003eA critical type confusion vulnerability, identified as CVE-2026-59940, exists in the \u003ccode\u003eseroval\u003c/code\u003e JavaScript serialization library, specifically within the \u003ccode\u003eseroval.fromJSON()\u003c/code\u003e function, affecting all versions prior to 1.5.3. This flaw allows an attacker to craft special JSON input that exploits a logic error where internal Promise resolver records are confused with attacker-controlled values during deserialization. When applications, particularly downstream server frameworks such as TanStack Start, deserialize untrusted Seroval JSON with plugins enabled, this type confusion can lead to the invocation of attacker-controlled methods or callable wrappers. This primitive could enable unintended server-side invocation, potentially resulting in remote code execution (RCE) or equivalent server compromise, depending on the application's exposed functionality. The issue was privately coordinated and fixed in \u003ccode\u003eseroval@1.5.3\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Malicious JSON\u003c/strong\u003e: An attacker crafts a specially designed Seroval JSON payload. This payload contains values that, due to the type confusion vulnerability (CVE-2026-59940), are engineered to be misinterpreted by \u003ccode\u003eseroval.fromJSON()\u003c/code\u003e as internal Promise resolver records.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeliver Payload\u003c/strong\u003e: The attacker sends this malicious Seroval JSON input to a vulnerable server-side application that uses \u003ccode\u003eseroval.fromJSON()\u003c/code\u003e for deserialization of untrusted client input.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitiate Deserialization\u003c/strong\u003e: The vulnerable application receives the untrusted JSON and passes it to \u003ccode\u003eseroval.fromJSON()\u003c/code\u003e for processing. This typically occurs when plugins are enabled in the Seroval configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTrigger Type Confusion\u003c/strong\u003e: During the deserialization, \u003ccode\u003eseroval.fromJSON()\u003c/code\u003e attempts to process Promise control nodes. Due to the type confusion flaw, it fails to properly verify the type of values from the general deserialization reference table, mistakenly treating attacker-controlled data as legitimate Promise resolver records.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInvoke Attacker-Controlled Methods\u003c/strong\u003e: This misinterpretation leads to the Promise control nodes operating on these attacker-controlled values, causing the unintended invocation of methods or callable wrappers that were defined through registered plugins in the downstream framework.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAchieve Server Compromise\u003c/strong\u003e: Depending on the specific methods invoked and the functionality exposed by the application's plugins, this arbitrary method invocation can lead to severe consequences, including remote code execution (RCE), arbitrary file manipulation, or other forms of server compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerable deserialization path can confuse attacker-created values with internal Seroval promise resolver records, leading to a deserialization side-effect primitive when untrusted JSON is processed with plugins enabled. The direct impact on applications using \u003ccode\u003eseroval\u003c/code\u003e is the ability for an attacker to influence program flow during deserialization. In downstream server frameworks, such as TanStack Start, which might register plugins returning callable wrappers, this vulnerability can be leveraged to trigger unintended server-side invocations. This can escalate to remote code execution (RCE), arbitrary file system access, or full server compromise, depending on the scope of the invoked methods. The vulnerability was privately validated against TanStack Start, confirming potential downstream exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eseroval\u003c/code\u003e package to version \u003ccode\u003e1.5.3\u003c/code\u003e or later immediately to mitigate CVE-2026-59940.\u003c/li\u003e\n\u003cli\u003eFor downstream projects accepting Seroval JSON from untrusted clients, implement defense-in-depth controls such as restricting accepted Seroval node types for client-to-server payloads.\u003c/li\u003e\n\u003cli\u003eRestrictively allowlist plugin tags for inbound deserialization processes to prevent unintended plugin activation.\u003c/li\u003e\n\u003cli\u003eAvoid registering plugins that produce callable or privileged values for untrusted inputs unless absolutely necessary.\u003c/li\u003e\n\u003cli\u003eImplement regression tests to ensure deserialization cannot cause unintended server-side invocation as a side effect.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:23:52Z","date_published":"2026-07-24T16:23:52Z","id":"https://feed.craftedsignal.io/briefs/2026-07-seroval-type-confusion/","summary":"A critical type confusion vulnerability, CVE-2026-59940, in `seroval.fromJSON()` versions prior to 1.5.3 allows attackers to provide malicious JSON input that misleads Promise control nodes into operating on attacker-controlled values, potentially leading to arbitrary method invocation and remote code execution or server compromise in downstream server frameworks like TanStack Start that deserialize untrusted input with plugins enabled.","title":"Seroval Type Confusion Vulnerability in fromJSON() Leads to Deserialization RCE","url":"https://feed.craftedsignal.io/briefs/2026-07-seroval-type-confusion/"}],"language":"en","title":"CraftedSignal Threat Feed - Seroval (Versions Prior to 1.5.3)","version":"https://jsonfeed.org/version/1.1"}