sveltejs/devalue · Security
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
- GHSA ID
- GHSA-4q55-j62x-fr9h
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Description
This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')