PT-2026-139848
CVE-2026-123567
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
3.7
LowMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.
Found an issue in the description? Have something to add? Feel free to write us 👾