What is GHSA-p6vx-979v-rg4c?

GHSA-p6vx-979v-rg4c is a security advisory published by GitHub Security Advisories with Critical severity. Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Which CVE IDs does GHSA-p6vx-979v-rg4c cover?

GHSA-p6vx-979v-rg4c covers the following CVE IDs: CVE-2026-104846. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p6vx-979v-rg4c?

GHSA-p6vx-979v-rg4c has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-p6vx-979v-rg4c?

GHSA-p6vx-979v-rg4c affects 1 product, including: npm/seroval:\u003e= 0.12.0, \u003c= 1.6.0.

GHSA-p6vx-979v-rg4cCriticalCVSS 9.8

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Vendor

GitHub Security Advisories

Published

October 5, 2026

Last Modified

October 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-104846 →

📋 Description

A fulfilled Promise node deserialized by fromJSON() can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from 0.12.0 through the current 1.6.0.

🎯 Affected products1

npm/seroval:>= 0.12.0, <= 1.6.0

🔗 References (4)

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c
https://nvd.nist.gov/vuln/detail/CVE-2026-104846
https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7
https://github.com/advisories/GHSA-p6vx-979v-rg4c