Threats tagged 'ghsa-2fcf-p6fg-p2wf'

A vulnerability in devalue versions before 5.9.3 allows attackers to bypass the __proto__ property rejection during parsing by using malformed null-prototype object keys through property-key coercion. This is an incomplete fix related to a previous advisory (GHSA-mwv9-gp5h-frr4). Although attackers can craft payloads that produce objects with a __proto__ own property, this alone does not lead to prototype pollution.