{"id":"ghsa-ghsa-7rv5-mrxv-xcr9","seq":2056917,"kind":"advisory","title":"Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check","url":"https://github.com/advisories/GHSA-7rv5-mrxv-xcr9","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7rv5-mrxv-xcr9","summary":"影響: npm:seroval <= 1.6.7 → 1.6.8\nWhen fromJSON rebuilt an async iterator, it called on() on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's on method. This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node. Impact An application that passes untrusted input to fromJSON with pl…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-116580"],"tags":["GHSA-7rv5-mrxv-xcr9","seroval"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:17:15.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}