PT-2026-22530 · Npm · Devalue

Publicado 2026-02-19 · Atualizado 2026-02-19

OSV

CVSS v4.0

2.1

Baixa

Vetor base

AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can be a different shape from the input data.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

GHSA-8QM3-746X-R74R

Produtos afetados

Devalue

Referências · 5

• https://github.com/sveltejs/devalue · Nota
• https://github.com/sveltejs/devalue/commit/0f04d4d678eac39ad5d7a07d1956275d7874e81c · Nota
• https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r · Nota
• https://github.com/sveltejs/devalue/releases/tag/v5.6.3 · Nota
• https://osv.dev/vulnerability/GHSA-8qm3-746x-r74r · Aviso do Fabricante