Description
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | devalue | < 5.9.3 | 5.9.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devalue | < 5.9.3 | 5.9.3 | GHSA-4q55-j62x-fr9h |
References
- GitHub Security Advisory (GHSA-4q55-j62x-fr9h) vendor-advisory
- VulnCheck Advisory: Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion third-party-advisory