Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-vj54-72f3-p5jv

Опубликовано: 26 авг. 2025
Источник: github
Github: Прошло ревью
CVSS4: 7.9

Описание

devalue prototype pollution vulnerability

1. devalue.parse allows __proto__ to be set

A string passed to devalue.parse could represent an object with a __proto__ property, which would assign a prototype to an object while allowing properties to be overwritten:

class Vector { constructor(x, y) { this.x = x; this.y = y; } get magnitude() { return (this.x ** 2 + this.y ** 2) ** 0.5; } } const payload = `[{"x":1,"y":2,"magnitude":3,"__proto__":4},3,4,"nope",["Vector",5],[6,7],8,9]`; const vector = devalue.parse(payload, { Vector: ([x, y]) => new Vector(x, y) }); console.log("Is vector", vector instanceof Vector); // true console.log(vector.x) // 3 console.log(vector.y) // 4 console.log(vector.magnitude); // "nope" instead of 5

2. devalue.parse allows array prototype methods to be assigned to object

In a payload constructed with devalue.stringify, values are represented as array indices, where the array contains the 'hydrated' values:

devalue.stringify({ message: 'hello' }); // [{"message":1},"hello"]

devalue.parse does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:

const object = devalue.parse('[{"toString":"push"}]'); object.toString(); // 0

This could be used by a creative attacker to bypass server-side validation.

Ссылки

Пакеты

Наименование

devalue

npm
Затронутые версииВерсия исправления

< 5.3.2

5.3.2

EPSS

Процентиль: 32%
0.00123
Низкий

7.9 High

CVSS4

CVE ID

CVE-2025-57820

Дефекты

CWE-1321

Связанные уязвимости

nvd логотип

CVE-2025-57820

nvd
5 месяцев назад

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

EPSS

Процентиль: 32%
0.00123
Низкий

7.9 High

CVSS4

CVE ID

CVE-2025-57820

Дефекты

CWE-1321