CVE-2026-123567

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

Referanslar

• https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4
• https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.4-prototype-injection-via-parse-and-unflatten