Executive brief
Seroval is a library used to serialize and deserialize complex JavaScript data structures. A vulnerability in its data processing allows an attacker to send specially crafted data that triggers unintended actions on the server. This can lead to unauthorized code execution or complete server compromise, especially when used in frameworks like TanStack Start.
Technical details
A type confusion vulnerability exists in the `seroval.fromJSON()` API due to insufficient verification of Promise resolver records. During deserialization, attacker-controlled JSON input can cause Promise control nodes to operate on values from the general reference table as if they were internal resolver records. If plugins are enabled—particularly those that return callable wrappers—an attacker can trigger unintended server-side function invocations. This primitive can be escalated to remote code execution (RCE) depending on the application's exposed functionality and registered plugins. The issue is fixed in version 1.5.3.
Affected products
- lxsmnsyc seroval <= 1.5.2
Timeline
- 2026-07-08: disclosed: Initial publication by lxsmnsyc/seroval
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Fix confirmed in version 1.5.3