Skip to content
OpenAdvisories

Product · sveltejs

devalue

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.4
    CVE-2026-123568

    Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output

    Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, produci…

    sveltejs devalue devalue npm
  • Medium 5.3
    CVE-2026-81176

    Svelte devalue: DoS via malformed input

    Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A…

    sveltejs devalue devalue npm
  • Medium 6.3
    CVE-2026-30226

    devalue has prototype pollution in devalue.parse and devalue.unflatten

    Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted pay…

    sveltejs devalue devalue npm