{"id":"CVE-2026-123567","kind":"vulnerability","aliases":["CVE-2026-123567"],"related":[],"title":"devalue: crafted input injects __proto__ into parsed objects","description":"Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.","summary":"devalue, a serialization library used by SvelteKit, lets crafted serialized input add __proto__ own properties to objects returned by devalue.parse and devalue.unflatten. When downstream code merges those results with Object.assign, the target object's prototype can be altered.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devalue","node.js","package","svelte","sveltekit"],"not_affected_if":["no-object-assign-merge","trusted-input-only"],"how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in package-lock.json, pnpm-lock.yaml or yarn.lock.\n- Check whether application code calls devalue.parse or devalue.unflatten on untrusted input and merges the result with Object.assign.","fix":"- devalue: move to `5.6.4` or later.","status":"open","published_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:25:06+00:00","updated_at":"2026-11-08T02:25:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:06Z","model":"claude-haiku-5-5","output":{"fix":"- devalue: move to `5.6.4` or later.","reach":"unknown","title":"devalue: crafted input injects __proto__ into parsed objects","impact":"medium","summary":"devalue, a serialization library used by SvelteKit, lets crafted serialized input add __proto__ own properties to objects returned by devalue.parse and devalue.unflatten. When downstream code merges those results with Object.assign, the target object's prototype can be altered.","audience":"developers","category":"package","nicknames":[],"who_cares":["devalue","sveltekit","svelte","node.js"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"prototype of merged objects altered, possibly changing application behavior","analyst_note":"Confirm whether SvelteKit's default code paths call devalue.parse on untrusted input, and check the vendor advisory on github.com for the exact impact.","how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in package-lock.json, pnpm-lock.yaml or yarn.lock.\n- Check whether application code calls devalue.parse or devalue.unflatten on untrusted input and merges the result with Object.assign.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-object-assign-merge"],"who_is_affected":"Applications that use devalue to deserialize data it did not produce itself, especially data that reaches devalue.parse or devalue.unflatten from a request or other untrusted source, and then merge the result into other objects with Object.assign. Projects that only serialize their own trusted data, or do not use devalue directly, are less exposed. unknown whether SvelteKit's default behavior exposes applications; the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4281,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123567':11A,14A '-2026':10A,13A '5.6.4':61C 'add':31B 'allow':68C 'alter':57B,96C 'attack':69C,82C 'code':44B,91C 'contain':62C 'craft':2A,28B,85C 'cve':9A,12A 'devalu':1A,15B,20B,59C 'devalue.parse':39B,79C 'devalue.unflatten':41B,81C 'downstream':43B,90C 'inject':4A,65C,71C 'input':3A,30B,87C 'let':27B 'librari':23B 'merg':45B,92C 'node.js':16B 'object':8A,36B,52B,76C,99C 'object.assign':49B,95C 'packag':17B 'pars':7A 'properti':34B,74C 'proto':5A,32B,72C 'prototyp':54B,64C,101C 'result':47B,93C 'return':37B,77C 'serial':22B,29B,86C 'suppli':84C 'svelt':18B 'sveltej':58C 'sveltekit':19B,26B 'target':51B,98C 'use':24B 'via':94C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Applications that use devalue to deserialize data it did not produce itself, especially data that reaches devalue.parse or devalue.unflatten from a request or other untrusted source, and then merge the result into other objects with Object.assign. Projects that only serialize their own trusted data, or do not use devalue directly, are less exposed. unknown whether SvelteKit's default behavior exposes applications; the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devalue","medium","nodejs","package","svelte","sveltekit"],"campaign_type":null,"search_a":"'-123567':11A,14A '-2026':10A,13A 'craft':2A 'cve':9A,12A 'devalu':1A 'inject':4A 'input':3A 'object':8A 'pars':7A 'proto':5A","search_b":"'add':31B 'alter':57B 'code':44B 'craft':28B 'devalu':15B,20B 'devalue.parse':39B 'devalue.unflatten':41B 'downstream':43B 'input':30B 'let':27B 'librari':23B 'merg':45B 'node.js':16B 'object':36B,52B 'object.assign':49B 'packag':17B 'properti':34B 'proto':32B 'prototyp':54B 'result':47B 'return':37B 'serial':22B,29B 'svelt':18B 'sveltekit':19B,26B 'target':51B 'use':24B","search_c":"'5.6.4':61C 'allow':68C 'alter':96C 'attack':69C,82C 'code':91C 'contain':62C 'craft':85C 'devalu':59C 'devalue.parse':79C 'devalue.unflatten':81C 'downstream':90C 'inject':65C,71C 'input':87C 'merg':92C 'object':76C,99C 'object.assign':95C 'properti':74C 'proto':72C 'prototyp':64C,101C 'result':93C 'return':77C 'serial':86C 'suppli':84C 'sveltej':58C 'target':98C 'via':94C 'vulner':66C","first_public_at":"2026-03-11T16:50:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123567","severity":null,"published_at":"2026-11-08T02:16:49+00:00","modified_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99285,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-03-11T16:50:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99286,"url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.4-prototype-injection-via-parse-and-unflatten","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}