High severity · published Aug 26, 2025
CVE-2025-57820
Svelte devalue vulnerable to prototype pollution
7.9
CVSS
0.4%
EPSS
No
On KEV
Description
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
devalue · sveltejs
< 5.3.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57820
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57820
github.com
https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132
github.com
https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv
More from devalue
7.5
CVE-2026-92708
devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
7.5
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
7.5
CVE-2026-30226
devalue has prototype pollution in devalue.parse and devalue.unflatten
7.5
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
7.5
CVE-2026-22774
devalue vulnerable to denial of service due to memory exhaustion in devalue.parse