Bug 2537833

Summary: CVE-2026-59940 forgejo: Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization [epel-all]
Product: [Fedora] Fedora EPEL Reporter: aedmond
Component: forgejoAssignee: Fedora Infrastructure SIG <infra-sig>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: epel10CC: amessina, gbailey, go-sig, infra-sig, nphilipp
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["92a1a0f6-a526-4817-91d4-1bddd5f435f4"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2517912    

Description aedmond 2026-09-22 13:07:52 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.