Threats tagged 'ghsa-8f8h-hxr2-jrh3'

Sveltejs devalue versions before 5.6.4 have a prototype injection vulnerability. This flaw allows attackers to inject __proto__ properties into objects returned by devalue.parse and devalue.unflatten. If downstream code merges these objects using Object.assign, the prototype of the target object can be altered. The vulnerability has a low severity score of 3.7 and does not impact confidentiality or availability but can cause integrity issues.