Prototype Injection in Sveltejs Devalue Library

Executive Summary

This vulnerability is a prototype injection flaw in the devalue library before version 5.6.4. It allows attackers to inject __proto__ properties into objects returned by devalue.parse and devalue.unflatten functions. When downstream code merges these objects using Object.assign, it can alter the target object's prototype, potentially changing application behavior.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the devalue npm package using 'npm list devalue' or 'npm ls devalue'. If the version is below 5.6.4, the system is vulnerable. Review code that uses devalue.parse or devalue.unflatten for improper Object.assign usage.

Useful 0 Not Useful 0

Impact Analysis

If your application uses devalue versions prior to 5.6.4 and merges objects with Object.assign, attackers could manipulate object prototypes. This might lead to unexpected behavior, data corruption, or security bypasses depending on how the application handles merged objects.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the devalue package to version 5.6.4 or later using 'npm update devalue'. Audit code for Object.assign usage with devalue outputs and replace with safer alternatives like spread operators or structuredClone.

Useful 0 Not Useful 0