{"action":"Upgrade seroval to 1.6.2 or later.","affected":[{"fixed":"1.6.2","introduced":"0.12.0"}],"component":"seroval","cve_ids":["CVE-2026-104846"],"ecosystem":"npm","epss":0.00345,"exploited":false,"fixed_versions":["1.6.2"],"ghsa_id":"GHSA-p6vx-979v-rg4c","id":"tcs_01M5KG2TJPSAZGHN6EE7PS6EQ5","modified_at":"2026-10-06T00:00:08.435171324Z","published_at":"2026-10-05T23:40:43Z","references":["https://osv.dev/vulnerability/GHSA-p6vx-979v-rg4c","https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c","https://nvd.nist.gov/vuln/detail/CVE-2026-104846","https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7","https://github.com/lxsmnsyc/seroval"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-p6vx-979v-rg4c","url":"https://osv.dev/vulnerability/GHSA-p6vx-979v-rg4c"}],"summary":"Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)"}