| Package | Affected versions | Patched versions |
|---|---|---|
| devalue | < 5.9.3 | 5.9.3 |
This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free