{"id":"GHSA-mwv9-gp5h-frr4","aliases":[],"url":"https://o3.security/vulnerability/GHSA-mwv9-gp5h-frr4","summary":"Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties","details":"In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a security vulnerability (and is possible with, for example, `JSON.parse` as well), but it can result in prototype injection if _downstream_ code handles it incorrectly:\n\n```ts\nconst result = devalue.parse(/* input creating an object with a __proto__ property */);\nconst target = {};\nObject.assign(target, result); // target's prototype is now polluted\n```","published":"2026-03-12T16:38:15Z","modified":"2026-06-26T20:45:12.205249352Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.6.4"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/87c1f3ce3759765a061cfe34843ecc4b0711ba8d","label":"sveltejs/devalue@87c1f3c"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/commit/87c1f3ce3759765a061cfe34843ecc4b0711ba8d"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.6.4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-26T20:45:12.205249352Z"}}