Valibot: record() issue paths can make flatten() throw for inherited Object property names

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59952 · Microsoft / collected KEV context

GHSA-5qjj-4xww-7phc

cve-program · CVE-2026-59952

• https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc
• https://github.com/open-circle/valibot/pull/1522
• https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf
• https://github.com/open-circle/valibot/releases/tag/v1.4.2

nvd · CVE-2026-59952

• https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf
• https://github.com/open-circle/valibot/pull/1522
• https://github.com/open-circle/valibot/releases/tag/v1.4.2
• https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc

osv · GHSA-5qjj-4xww-7phc

• https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc
• https://github.com/open-circle/valibot/pull/1522
• https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf
• https://github.com/open-circle/valibot
• https://github.com/open-circle/valibot/releases/tag/v1.4.2

No related operational record is retained in the current change model.