CVE-2025-57820CWE-1321

Svelte devalue vulnerable to prototype pollution

High · published August 26, 2025

CVSS v4.0
7.9
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

The record
Technical detail
CVSS v4.0
7.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00369 · 29.7th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2025-08-26T22:33Z
EPSS history
Timeline
  • 26 AUG 22:33Z
    Svelte devalue vulnerable to prototype pollution
    cvelistv5