devalue before 5.9.3 Prototype Pollution via Malformed Keys

Executive Summary

This vulnerability affects the devalue npm package before version 5.9.3. It allows attackers to bypass the parse function's rejection of __proto__ properties by using malformed null-prototype object keys through property-key coercion. This creates objects with a __proto__ own property but does not directly cause prototype pollution.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the devalue package using npm list devalue or npm list -g devalue. If the version is below 5.9.3, the system is vulnerable. Review application code that uses devalue for parsing user input, especially where object keys are processed.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited as the vulnerability does not directly cause prototype pollution. However, it could potentially allow attackers to manipulate object prototypes in unexpected ways, which might lead to secondary issues depending on the application's use of devalue.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the devalue package to version 5.9.3 or later using npm update devalue or npm install devalue@latest. If upgrading is not immediately possible, review and sanitize all user-supplied input before passing it to devalue's parse function.

Useful 0 Not Useful 0