Prototype Pollution in Sveltejs Devalue

CVE-2025-57820

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning pro…

Vulnerability class: Prototype Pollution

EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.

Affected products

Sveltejs Devalue — versions < 5.3.2

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)