Seroval CVE-2026-116580

Two concrete prerequisites must both hold: (1) the application passes attacker-controlled/untrusted input to seroval's fromJSON deserializer, and (2) the application registers a Seroval plugin whose deserialize returns a callable value or an object exposing an 'on' method. The crafted node reuses an identifier so the AsyncIteratorFactoryInstance rebuild calls source.on(listener) on that plugin value. Limiting factors that reduce realistic risk: the vulnerable plugin behavior is a non-default, application-specific choice (absent such a plugin the attacker-chosen value cannot be meaningfully invoked); the resulting impact is bounded entirely by what the plugin's callable does; and only versions up to 1.6.7 are affected (1.6.4-1.6.7 block the originally reported payload but remain bypassable via node-id reuse).

The input CVSS of 7.3 (High) with vector AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L makes this look like a broadly exploitable network flaw, but the supporting signals and the description pull the real-world risk lower. EPSS is only 0.34% (28th percentile) and there is no CISA KEV listing and no public exploit reference in the input, so there is no evidence of active or at-scale exploitation. The vuln.today decision label is 'this_week,' indicating a scheduled-remediation priority rather than act_now/emergency. The most important nuance is a conflict between the AC:L in the supplied vector and the description: exploitation is not possible against a default seroval deployment - it requires BOTH that the application feeds untrusted input to fromJSON AND that it registers a plugin whose deserialize returns a callable value or an object exposing an 'on' method. That plugin configuration is a condition beyond the attacker's control, which argues for AC:H rather than AC:L. The C:L/I:L/A:L impact is also explicitly indeterminate - the advisory states the actual confidentiality/integrity/availability effect 'depends on what the plugin's values do,' so Low is a conservative floor, not a measured ceiling. Net: a genuine deserialization (CWE-502) issue worth patching on a near-term schedule, but gated by application-specific plugin usage rather than a widely-exploitable default-config bug.

An application running seroval 1.6.7 or earlier deserializes attacker-supplied data with fromJSON while also using a plugin whose deserialize returns a callable value (or an object with an 'on' method). The attacker submits a crafted payload that reuses a node identifier so that rebuilding an AsyncIteratorFactoryInstance calls source.on(listener) on the plugin-produced value instead of a genuine internal stream, invoking attacker-chosen behavior during deserialization. No public exploit was identified at time of analysis, and the attack only works where that specific plugin configuration is present.