MEDIUM 6.3 NVD
CVE-2026-123561
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.
References
- https://github.com/sveltejs/devalue/security/advisories/GHSA-4q55-j62x-fr9h
- https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-proto-rejection-bypass-
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.