Skip to content
OpenAdvisories

Product · sveltejs

devalue

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-123567

    Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

    Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstre…

    sveltejs devalue devalue npm
  • Low 3.7
    CVE-2026-123561

    Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

    devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own prop…

    sveltejs devalue devalue npm