Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123561— Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

Quick assessment

Affected
sveltejs devalue
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

devalue 5.9.3 之前的版本存在漏洞：攻击者可利用畸形的 null 原型对象键，通过属性键强制转换绕过 parse 函数对 的拒绝机制。该问题是对 GHSA-mwv9-gp5h-frr4 漏洞修复不彻底所致。攻击者可构造特定载荷，生成拥有 自身属性的对象；但仅凭该自身属性本身并不会直接导致原型污染。

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123561

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
Source: CVE Program / CVE List V5
Vulnerability Description
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sveltejs devalue 0 ~ 5.9.3 -

II. Public POCs for CVE-2026-123561

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123561

请登录查看更多情报信息。

Other References for CVE-2026-123561 (2)

Same Patch Batch · sveltejs · 2026-11-08 · 9 CVEs total

CVE-2026-123564 7.5 HIGH Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-123566 7.5 HIGH Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
CVE-2026-123569 7.5 HIGH Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
CVE-2026-123563 7.5 HIGH Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
CVE-2026-123562 7.5 HIGH Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123565 7.5 HIGH Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
CVE-2026-123568 4.4 MEDIUM Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
CVE-2026-123567 3.7 LOW Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

IV. Related Vulnerabilities

Same product: devalue
Same vendor: sveltejs
Same weakness: CWE-1321