medium · CVSS v3 3.7 · CVSS v4 6.3

CVE-2026-123567

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ properties via devalue.

Overview

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ properties via devalue.parse and devalue.unflatten. This can alter object prototypes when merged with Object.assign, potentially changing application behavior. The flaw is exploitable in any code that uses devalue to deserialize data.

Description

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

Impact

Confidentiality: prototype changes can expose sensitive data if merged objects are used in security checks. Integrity: attackers can modify application logic by altering prototypes, leading to unintended behavior. Availability: not directly impacted. Defenders: developers using devalue in client‑side or server‑side code should be aware of this risk.

Remediation

Upgrade devalue to version 5.6.4 or later. If an upgrade is not immediately possible, validate and sanitize input to reject any keys named __proto__ before calling devalue.parse or devalue.unflatten. After merging, reset the prototype with Object.setPrototypeOf(target, Object.prototype) or use a safe merge that ignores prototype properties.

Risk context

The vulnerability has a medium severity rating (CVSS v3 3.7, CVSS v4 6.3) and no EPSS data is available. While it does not pose an immediate high‑risk threat, it should be addressed promptly to prevent potential integrity and confidentiality issues.

Affected products

  • Svelte.js
  • devalue
  • SvelteKit
  • Svelte apps

Scores

Severity
medium
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
6.3
EPSS
—

prototype-injection devalue svelte medium client-side library

← All CVEs

Related CVEs

medium

CVE-2026-97194

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis

medium

CVE-2026-124326

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis

medium

CVE-2026-123503

Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling default/done bucket references and inconsistent task buckets.

View analysis

medium

CVE-2026-123504

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.

View analysis