Improperly Controlled Modification of Dynamically-Determined Object Attributes in devalue - #VU127521

Detailed vulnerability description

The vulnerability allows a remote attacker to inject properties into object prototypes.

The vulnerability exists due to improper control of dynamically determined object attributes in devalue.parse and devalue.unflatten when parsing input that creates objects with __proto__ own properties. A remote attacker can supply crafted input to inject properties into object prototypes.

Exploitation requires downstream code to handle the emitted object in an unsafe way, such as copying its properties into another object.

Remediation

Sources

• https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4