CVE-2026-123561

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.

Referanslar

• https://github.com/sveltejs/devalue/security/advisories/GHSA-4q55-j62x-fr9h
• https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-proto-rejection-bypass-via-property-key-coercion