{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104846", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-02T14:38:43.243Z", "datePublished": "2026-10-02T15:59:45.802Z", "dateUpdated": "2026-10-05T20:10:22.499Z"}, "containers": {"cna": {"title": "Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)", "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "lang": "en", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c"}, {"name": "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7"}], "affected": [{"vendor": "lxsmnsyc", "product": "seroval", "versions": [{"version": ">= 0.12.0, < 1.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-02T15:59:45.802Z"}, "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2."}], "source": {"advisory": "GHSA-p6vx-979v-rg4c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T20:10:15.390924Z", "id": "CVE-2026-104846", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T20:10:22.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-05T20:10:15.390924Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T20:10:19.690Z"}}], "cna": {"title": "Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)", "source": {"advisory": "GHSA-p6vx-979v-rg4c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxsmnsyc", "product": "seroval", "versions": [{"status": "affected", "version": ">= 0.12.0, < 1.6.2"}]}], "references": [{"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c", "name": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7", "name": "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-02T15:59:45.802Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104846", "state": "PUBLISHED", "dateUpdated": "2026-10-05T20:10:22.499Z", "dateReserved": "2026-10-02T14:38:43.243Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-02T15:59:45.802Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "seroval", "vendor": "lxsmnsyc", "versions": [{"status": "affected", "version": ">= 0.12.0, < 1.6.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2."}], "id": "CVE-2026-104846", "lastModified": "2026-10-05T21:16:32.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104846", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T20:10:15.390924Z", "version": "2.0.3"}}]}, "published": "2026-10-02T16:16:47.230", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7"}, {"source": "security-advisories@github.com", "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)", "id": "2545276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545276"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-843", "details": ["Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.", "A type confusion vulnerability was found in the seroval npm package. The fromJSON() deserialization function, when processing a fulfilled Promise control node, can pass a plugin-produced callable-bearing thenable to a native ECMAScript Promise resolver. Thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code execution in applications using plugin-capable seroval releases (versions 0.12.0 through 1.6.1). This issue bypasses the Promise resolver type-confusion fix in version 1.5.3 (CVE-2026-59940) because the invocation occurs through native Promise settlement after the referenced value is deserialized."], "mitigation": {"lang": "en:us", "value": "Update the seroval package to version 1.6.2 or later, which adds an isThennable() guard that rejects deserialized Promise values with a .then method."}, "name": "CVE-2026-104846", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_orchestrator:2026.8", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-orchestrator-ui-rhel9", "product_name": "Ansible Automation Orchestrator 2026"}], "public_date": "2026-10-02T15:59:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104846\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104846\nhttps://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7\nhttps://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c"], "statement": "A type confusion flaw was found in seroval, an npm library for JavaScript value serialization. When deserializing JSON via fromJSON(), a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger unintended code execution in applications that use seroval with plugins. This issue is a bypass of the fix for CVE-2026-59940, which addressed a related type-confusion in the Promise resolver path. The new exploitation vector operates through native Promise settlement after the referenced value is deserialized, circumventing the earlier guard. Red Hat Ansible Automation Orchestrator ships seroval 1.5.6 with seroval-plugins as a production dependency in the automation-orchestrator-ui container. Exploitation requires an authenticated attacker to inject crafted serialized JSON into a code path that calls fromJSON().", "threat_severity": "Important"}