GHSA-4q55-j62x-fr9h

About vulnerability

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.

Affected product:

ai-sdk-angular , ai-sdk-assemblyai , ai-sdk-cerebras , ai-sdk-deepgram , ai-sdk-deepinfra , ai-sdk-deepseek , ai-sdk-elevenlabs , ai-sdk-fal , ai-sdk-gateway , ai-sdk-gladia , ai-sdk-harness , ai-sdk-harness-codex , ai-sdk-harness-cursor , ai-sdk-harness-deepagents , ai-sdk-harness-fx , ai-sdk-harness-opencode , ai-sdk-harness-pi , ai-sdk-hume , ai-sdk-langchain , ai-sdk-llamaindex , ai-sdk-lmnt , ai-sdk-luma , ai-sdk-otel , ai-sdk-policy-opa , ai-sdk-replicate , ai-sdk-revai , ai-sdk-rsc , ai-sdk-sandbox-just-bash , ai-sdk-sandbox-vercel , ai-sdk-togetherai , ai-sdk-valibot , ai-sdk-vercel , ai-sdk-workflow , ai-sdk-workflow-harness , astro , astrojs-internal-helpers , astrojs-markdown-remark , astrojs-prism , astrojs-svelte , astrojs-underscore-redirects , astrojs-upgrade , devalue , nuxt , orama-orama , workflow , workflow-ai , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nitro , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-swc-plugin , workflow-utils , workflow-vite , workflow-vitest , workflow-web , workflow-web-shared , workflow-world , workflow-world-testing , workflow-world-vercel

Affected packages:

devalue @ 2.0.1 (+903 more)