What is GHSA-8f8h-hxr2-jrh3?

GHSA-8f8h-hxr2-jrh3 is a security advisory published by GitHub Security Advisories with Medium severity. Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers...

Which CVE IDs does GHSA-8f8h-hxr2-jrh3 cover?

GHSA-8f8h-hxr2-jrh3 covers the following CVE IDs: CVE-2026-123567. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8f8h-hxr2-jrh3?

GHSA-8f8h-hxr2-jrh3 has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-8f8h-hxr2-jrh3MediumCVSS 3.7

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123567 →

📋 Description

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

🔗 References (4)

https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4
https://nvd.nist.gov/vuln/detail/CVE-2026-123567
https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.4-prototype-injection-via-parse-and-unflatten
https://github.com/advisories/GHSA-8f8h-hxr2-jrh3