lxsmnsyc

Monday, October 5

• GitHub CVE-2026-104846
  Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

  • lxsmnsyc seroval
  • Critical
  • CVSS 9.8
  • EPSS 0.35%
  • Fixed version listed
  23:40 UTC