{"schema":"threatline.record/2","record":{"id":"CVE-2026-116580","aliases":["GHSA-7rv5-mrxv-xcr9"],"summary":"Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check","details":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.","categories":["Unclassified"],"product":"seroval","vendor":"lxsmnsyc","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116580","source_modified_at":"2026-10-26T20:35:49.975Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"seroval","vendor":"lxsmnsyc","versions":[{"version":"< 1.6.8","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T20:35:49.975Z","modified_at":"2026-10-26T20:35:49.975Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116580","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T20:35:49.975Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T20:35:49.975Z","content_hash":"d74596498ca29f02b265f7fe3d0c35f1df6a2ed96b4ac5b1ce6428bf8452b487"}}