CVE-2026-123567

Versions of Sveltejs devalue prior to 5.6.4 are vulnerable to a prototype injection flaw. The root cause is that the devalue.parse and devalue.unflatten functions allow attackers to inject proto own properties into returned objects. If downstream code merges these results using Object.assign , ...