Description
Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | devalue | < 5.6.4 | 5.6.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devalue | >= 4.0.0, < 5.6.4 | 5.6.4 | GHSA-mwv9-gp5h-frr4 |
References
- GitHub Security Advisory (GHSA-mwv9-gp5h-frr4) vendor-advisory
- VulnCheck Advisory: Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten third-party-advisory