Executive brief
The devalue library, used for serializing and deserializing JavaScript objects, contains a flaw where it can produce objects containing a special internal property. If a developer then merges this object into another one using common programming patterns, it could allow an attacker to modify the behavior of the application. This could lead to unauthorized changes to data or application logic.
Technical details
The `devalue.parse` and `devalue.unflatten` functions in the Sveltejs devalue library can emit objects containing `__proto__` as an 'own property'. While not a direct vulnerability in isolation, this behavior facilitates prototype pollution (CWE-1321) when the resulting object is used with operations like `Object.assign()` or spread syntax on a target object. An attacker providing a specially crafted serialized string can inject properties into the global Object prototype if the application performs such merges. This issue is fixed in version 5.6.4.
Affected products
- Sveltejs devalue >= 4.0.0, < 5.6.4
Timeline
- 2026-03-11: patched: Fixed in version 5.6.4
- 2026-03-12: disclosed: GitHub Advisory published
References
- https://api.github.com/users/elliott-with-the-longest-name-on-github
- https://github.com/elliott-with-the-longest-name-on-github
- https://api.github.com/users/elliott-with-the-longest-name-on-github/gists%7B/gist_id%7D
- https://api.github.com/users/elliott-with-the-longest-name-on-github/repos
- https://avatars.githubusercontent.com/u/76245373?v=4
- https://api.github.com/users/elliott-with-the-longest-name-on-github/events%7B/privacy%7D