Seroval's fromJSON function processes JSON that can include Promise control nodes. When an attacker supplies Promise nodes that reference methods from the general deserialization reference table, the implementation fails to verify that the referenced resolver records are valid internal Promise resolvers. This type confusion allows a malicious payload to invoke attacker-controlled methods during deserialization, potentially leading to server‑side execution of unintended code. The weakness is identified as a serializable deserialization flaw (CWE‑502) and a type confusion error (CWE‑843).

The vulnerability affects the JavaScript library Seroval provided by lxsmnsyc. Versions prior to 1.5.3 are vulnerable, particularly when plugins are enabled that register callable wrappers. Any application or framework that uses seroval.fromJSON to deserialize untrusted data without patching may be impacted.

The CVSS score of 9.8 indicates a critical severity. Although an EPSS score is not available, the lack of KEV listing does not reduce the risk of exploitation, as no known public exploits are recorded yet. The attack vector is likely the injection of malicious JSON via user input or network traffic processed by the application, triggering the deserialization path. If an attacker can supply such payloads, the consequence can be remote code execution or unintended server‑side method invocation.