6.3
Medium
CVE-2026-123561 Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
Description
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| devalue 5.9 | earliest → < 5.9.3 | 5.9.3 |
Other CVEs of devalue
The 16 CVEs of devalue →
CVE-2026-123569
Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
8.7
High
CVE-2026-123568
Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
2.1
Low
CVE-2026-123566
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
8.7
High
CVE-2026-123567
Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
6.3
Medium