Snyk Security Database

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Prototype Pollution via the unflatten function in src/parse.js, where object keys parsed from untrusted input are not validated to be strings before being set on the target object. An attacker who controls the serialized input can supply a non-string key (such as a numeric or symbol-like value) that bypasses the existing __proto__ guard, potentially polluting the prototype chain of the resulting object and influencing downstream application behavior.

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC) call that follows existing symlinks at the target path. An attacker can craft a repository that places a symlink pointing outside the work tree at a known path, then have a victim perform a path-restricted checkout, causing attacker-controlled content to be written to arbitrary locations the user can write to - including .git/hooks for code execution. The fix routes all writes through build_file_from_blob, which replaces a symlink at the target rather than following it.

Affected versions of this package are vulnerable to Improper Certificate Validation in LeafNode.verify() in org.bouncycastle.mls.codec, which never checks that the subject public key of the X.509 credential's end entity certificate matches the leaf's signature_key field, although RFC 9420 section 5.3 requires the two to represent the same identity. An attacker can be admitted to an MLS group under a victim's X.509 identity and decrypt the group messages that follow, by presenting the victim's certificate as their credential while signing the leaf with an unrelated key they control. This affects applications using the MLS implementation, with no second check available, since both KeyPackage.verify() and the Group leaf validation path authenticate through that same method, and validating the certificate chain to a trust anchor is a separate concern that the application handles and that does not establish this binding.