Vulnerability GHSA-8qm3-746x-r74r
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
February 19, 2026 at 08:29 PM UTC
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
<5.6.3
<5.6.3
Summary
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
Details
Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can be a different shape from the input data.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 month ago
devalue: `stringify`/`uneval` serialize shared memory
>=5.1.0 <5.9.3 GHSA-j22f-vq7h-c4qm
>=5.1.0 <5.9.3 GHSA-j22f-vq7h-c4qm
Medium Risk
1 month ago
devalue: Residual sparse-array CPU amplification in uneval
<5.9.3 GHSA-hx4r-w6wj-j8fg
<5.9.3 GHSA-hx4r-w6wj-j8fg
High Risk
1 month ago
devalue: Repeated primitive strings cause quadratic expansion in uneval
<5.9.3 GHSA-mcm9-63f2-9j32
<5.9.3 GHSA-mcm9-63f2-9j32
Low Risk
1 month ago
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
>=1.0.0 <5.9.3 GHSA-wf3x-273g-mvxv
>=1.0.0 <5.9.3 GHSA-wf3x-273g-mvxv
High Risk
1 month ago
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
<5.9.3 GHSA-r9w8-h9r3-54w4
<5.9.3 GHSA-r9w8-h9r3-54w4
Impacted packages
Timeline
Published
8 months ago
February 19, 2026 at 08:29 PM UTC
Fixed (5.6.3)
8 months ago
February 18, 2026 at 05:50 PM UTC
Last Modified
12 hours ago
November 08, 2026 at 10:56 AM UTC