N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8qm3-746x-r74r

GHSA-8qm3-746x-r74r: devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can be a different shape from the input data.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8qm3-746x-r74r

GHSA-8qm3-746x-r74r:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devalue	npm	<= 5.6.2	5.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way the devalue library handled object serialization and deserialization, specifically concerning the __proto__ property, which is a known vector for prototype pollution attacks in JavaScript. The core issue was the use of for...in loops in the uneval, stringify, and unflatten functions. A for...in loop iterates over all enumerable properties of an object, including those inherited from its prototype chain. An attacker could provide a crafted object (e.g., JSON.parse('{"__proto__":{"polluted":true}}')) to these functions. The for...in loop would then iterate over the __proto__ property, causing the library to generate a string of code. When this output string is later executed by eval(), it modifies the global Object.prototype, polluting it with properties controllable by the attacker. The patch addresses this by replacing all instances of for...in with for (const key of Object.keys(...)), which only iterates over an object's own properties, and by adding explicit checks to throw an error if a key is named __proto__, thus preventing the pollution vector.

Vulnerable functions

unflatten

src/parse.js

The `unflatten` function used a `for...in` loop to iterate over object properties. This is unsafe as it can iterate over properties from the object's prototype chain. If the prototype is polluted, this function would process malicious properties. The patch replaces it with `Object.keys()` which only iterates over the object's own properties and adds a check to throw an error if the key is `__proto__`.

stringify

src/stringify.js

The `stringify` function used `for...in` loops to iterate over object keys for serialization. This could lead to the inclusion of unintended properties from a polluted prototype in the stringified output. The patch mitigates this by switching to `Object.keys()` and explicitly blocking keys named `__proto__`.

uneval

src/uneval.js

The `uneval` function, which is central to the vulnerability, used a `for...in` loop. This allowed it to process objects with a `__proto__` key, generating output that, when `eval`ed, would pollute the `Object.prototype`. The fix replaces the unsafe loop with `Object.keys()` and adds a specific check to prevent the processing of `__proto__` keys.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.