CVE-2026-123568

MEDIUM 4.4

Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

CWE	CWE-1321
Vendor	sveltejs
Product	devalue
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for sveltejs devalue

Be the first to know when new medium vulnerabilities affecting sveltejs devalue are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

sveltejs / devalue

0 < 5.6.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r vulncheck.com: https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.3-prototype-pollution-via-uneval-output

Credits

elliott-with-the-longest-name-on-github