GHSA-4q55-j62x-fr9h
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
devaluenpmLibraries & packages
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.9.3devalue, npmGitHub
npm install devalue@5.9.3
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.
Text from GitHub Advisory Database
Affected versions 2
- devalue, npm<= 5.9.2GitHub
- devalue, npmfrom first release, fixed in 5.9.3OSV