2.1
Low
CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
Description
Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- High
- Interaction
- None
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
- Confidentiality of other systems
- Low
- Integrity of other systems
- Low
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| devalue 5.6 | earliest → < 5.6.3 | 5.6.3 |
Other CVEs of devalue
The 16 CVEs of devalue →
CVE-2026-123569
Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
8.7
High
CVE-2026-123566
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
8.7
High
CVE-2026-123567
Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
6.3
Medium
CVE-2026-123565
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
8.7
High