Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

影響: npm:seroval <= 1.6.7 → 1.6.8

When fromJSON rebuilt an async iterator, it called on() on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's on method. This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node. Impact An application that passes untrusted input to fromJSON with pl…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:17, GitHub Advisory Database에서 "Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-116580.