CVE-2026-123567Low· 3.7▾ SunlitSveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized inp…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.
devalue < 5.6.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123561Low· 3.7Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
CVE-2026-123568Medium· 4.4Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
GHSA-4q55-j62x-fr9hMediumdevalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
CVE-2026-123562High· 7.5Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123564High· 7.5Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-123563High· 7.5Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse