Tools AI-Found Vulnerability Register aifv-0113
Register entry
Seroval: type confusion can cause denial of service
- GHSA
- GHSA-9355-h2pj-8fqj
- Project
- Seroval
- Component
- Seroval
- Finder
- Taskflow Agent
- Autonomy
- AI discovery with manual human verification
- Evidence tier
- Claim outside the record
- Confidence
- CONFIRMED
What happened
GitHub Security Lab attributes a TypedArray/DataView deserialisation finding to its Taskflow Agent, with human verification.
Credit as recorded: null. GHSL dates the fix in 1.6.4 to 25 August and advisory publication to 28 September. The maintainer’s affected field says <1.6.3 and its patched field says 1.6.4; this record preserves that source wording. No CVE is assigned to this variant. The older CVE-2026-59940 is a related earlier issue, and is not the identifier for this finding. Explicit public AI attribution followed on 22 October. Date basis: GHSL disclosure explicitly attributing AI discovery.
Sources
- GitHub Security Lab disclosuresecuritylab.github.com/advisories/GHSL-2026-200_Seroval/
- Maintainer advisorygithub.com/lxsmnsyc/seroval/security/advisories/GHSA-9355-h2…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026