PT-2026-27026 · Npm · Devalue

Publicado

2026-03-12

·

Atualizado

2026-03-12

CVSS v4.0

2.7

Baixa

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
In some circumstances, devalue.parse and devalue.unflatten could emit objects with proto own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:
ts
const result = devalue.parse(/* input creating an object with a  proto  property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted

Correção

Prototype Pollution

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

GHSA-MWV9-GP5H-FRR4

Produtos afetados

Devalue