GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
The devalue library can emit objects with __proto__ properties, potentially leading to prototype pollution if downstream code uses unsafe assignment methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mwv9-gp5h-frr4?
GHSA-mwv9-gp5h-frr4 is a vulnerability in devalue, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:
const result = devalue.parse(/* input creating an object with a __proto__ property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted
Which versions are affected by GHSA-mwv9-gp5h-frr4?
2 open source packages ship an affected version, including devalue.
| Package | Affected | Fixed in |
|---|---|---|
devalue npm | From 4.0.0 | 5.6.4 |
devalue npm | From 4.0.0 | 5.6.4 |
How do I fix GHSA-mwv9-gp5h-frr4?
Upgrade devalue to 5.6.4 or later.
Is GHSA-mwv9-gp5h-frr4 being exploited?
There is no known exploitation of GHSA-mwv9-gp5h-frr4 in the wild and no public exploit code.