CVE-2025-57820

high

Description

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

References

https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv

https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132

Details

Source: Mitre, NVD

Published: 2025-08-26

Updated: 2025-08-26

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 7.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Severity: High

EPSS

EPSS: 0.00045