PT-2026-27026 · Npm · Devalue

Published

2026-03-12

·

Updated

2026-03-12

CVSS v4.0

2.7

Low

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
In some circumstances, devalue.parse and devalue.unflatten could emit objects with proto own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:
ts
const result = devalue.parse(/* input creating an object with a  proto  property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted

Fix

Prototype Pollution

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1321

Related Identifiers

GHSA-MWV9-GP5H-FRR4

Affected Products

Devalue