Prototype Injection Vulnerability in Sveltejs Devalue Product by Svelte

CVE-2026-123567

What is CVE-2026-123567?

Sveltejs devalue prior to version 5.6.4 is susceptible to a prototype injection vulnerability. This flaw allows malicious actors to inject their own properties into objects returned by the devalue.parse and devalue.unflatten methods. By supplying specially crafted serialized input, an attacker can manipulate how target objects are constructed when results are merged using Object.assign, potentially compromising the integrity and security of applications leveraging this library.

References