Improperly Controlled Modification of Dynamically-Determined Object Attributes in devalue - #VU127521

Vulnerability details

The vulnerability allows a remote attacker to inject properties into object prototypes.

The vulnerability exists due to improper control of dynamically determined object attributes in devalue.parse and devalue.unflatten when parsing input that creates objects with __proto__ own properties. A remote attacker can supply crafted input to inject properties into object prototypes.

Exploitation requires downstream code to handle the emitted object in an unsafe way, such as copying its properties into another object.

Affected software

Remediation

External References

• https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4

Related Security Bulletins

• Multiple vulnerabilities in devalue