CVE-2026-123567
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.