AIKIDO-2026-476182

TL;DR

The fromJSON() deserialization path in seroval handles Promise control nodes by operating on values taken from the general deserialization reference table without first verifying that those values are genuine internal promise resolver records. Attacker-controlled JSON can exploit this type confusion so that deserialization performs attacker-influenced side effects when plugins are enabled. In downstream frameworks that register plugins returning callable wrappers, this primitive can escalate to unintended server-side invocation and potential remote code execution. The fix adds an internal type check so deserialization aborts before operating on values that are not genuine resolver records.