The vulnerability in devalue before 5.9.3 allows malformed null‑prototype object keys to circumvent the library’s rejection of __proto__ keys by exploiting property‑key coercion. An attacker can craft payloads that produce objects with a __proto__ own property; although this alone does not cause prototype pollution, it bypasses built‑in safeguards and could be leveraged in combination with other flaws to tamper with object prototypes.

The affected product is sveltejs devalue. Versions earlier than 5.9.3 are vulnerable, including all releases prior to 5.9.3.

The CVSS score of 6.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been reported. The likely attack vector is an application that uses devalue.parse on untrusted input; by injecting crafted data the attacker can bypass __proto__ validation. Because the failure does not in itself cause prototype pollution, the direct impact is limited but could elevate risk if attacker combines this with additional flaws. Monitoring for abnormal object keys and applying the patch mitigates the threat.