AIKIDO-2026-310861

TL;DR

seroval's fromJSON() resolves and rejects deserialized Promise nodes by passing the raw decoded value to the promise's resolver, without checking whether that value is itself a thenable. A plugin produced object with a then method reaches this path, so native Promise mechanics invoke it automatically once the payload settles the promise, letting the deserialized data trigger an unintended callable. This bypasses the earlier type-confusion guard added for the same class of issue and reaches every plugin capable release. The fix rejects any deserialized value exposing a then function before it can settle a promise.