CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...