TI-2025-35703 Aliases CVE-2025-57820 GHSA-vj54-72f3-p5jv

Svelte devalue vulnerable to prototype pollution

LOW 35CWE-1321Published 2025-08-26 · Updated 2025-08-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00369 31st percentileScored 2026-11-07

Fix Fixed devalue (sveltejs): 5.3.2devalue (npm): 5.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sveltejs	devalue	before 5.3.2	5.3.2	Patch available	CNA
—	devalue (npm)	before 5.3.2	5.3.2	Patch available	GHSA-vj54-72f3-p5jv

devalue Vendorsveltejs Affected before 5.3.2 Fixed in 5.3.2 Patch available CNA
devalue (npm) Vendor— Affected before 5.3.2 Fixed in 5.3.2 Patch available GHSA-vj54-72f3-p5jv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:svelte:devalue::::::::	—	—	sveltejs

cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:* Versions — — ·sveltejs

Remediation

Fix · CNA devalue (sveltejs) Fixed in 5.3.2
Fix · GHSA-vj54-72f3-p5jv devalue (npm) Fixed in 5.3.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-57820
2026-10-03 Alias added: GHSA-vj54-72f3-p5jv

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-57820

Other 3

TI-2023-13469 SvelteKit framework has Insufficient CSRF protection for CORS requests CVSS 3.1HIGH 8.8
TI-2023-13464 SvelteKit has Insufficient Cross-Site Request Forgery Protection CVSS 3.1HIGH 8.8
TI-2024-15660 Sending a GET or HEAD request with a body crashes SvelteKit CVSS 3.1HIGH 7.5
TI-2024-30159 Potential mXSS vulnerability due to improper HTML escaping in svelte CVSS 3.1MEDIUM 6.1
TI-2025-23466 SvelteKit allows XSS via tracked search_params CVSS 3.1MEDIUM 5.4
TI-2025-13940 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVSS 4.0MEDIUM 5.3

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences