devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

Description

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties.

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.9.2
• Patched version(s): 5.9.3

References

• GHSA-4q55-j62x-fr9h
• CWE-1321