Read the docs
TI-2026-86709 Aliases CVE-2026-123567GHSA-8f8h-hxr2-jrh3

Prototype injection in Sveltejs devalue via parse and unflatten

Priority LOW 28CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sveltejs devalue before 5.6.4 contains a prototype injection flaw in its parsing code, tracked as CWE-1321. Crafted serialized input can inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. An unauthenticated remote attacker can exploit this when downstream code merges the results with Object.assign, which alters the target object's prototype.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

Why it matters now

EPSS 0.00237 14th percentileScored 2026-11-08
Fix Fixed devalue (sveltejs): 5.6.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
sveltejsdevaluebefore 5.6.45.6.4Patch availableCNA
  • devalue Vendorsveltejs Affected before 5.6.4 Fixed in 5.6.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:*——sveltejs
  • cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:* Versions — — ·sveltejs

Remediation

Update sveltejs devalue to version 5.6.4 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA devalue (sveltejs) Fixed in 5.6.4

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123567
  2. 2026-11-08 Alias added: GHSA-8f8h-hxr2-jrh3
  3. 2026-11-09 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-13469 SvelteKit framework has Insufficient CSRF protection for CORS requests CVSS 3.1HIGH 8.8
  • TI-2023-13464 SvelteKit has Insufficient Cross-Site Request Forgery Protection CVSS 3.1HIGH 8.8
  • TI-2024-15660 Sending a GET or HEAD request with a body crashes SvelteKit CVSS 3.1HIGH 7.5
  • TI-2024-30159 Potential mXSS vulnerability due to improper HTML escaping in svelte CVSS 3.1MEDIUM 6.1
  • TI-2025-23466 SvelteKit allows XSS via tracked search_params CVSS 3.1MEDIUM 5.4
  • TI-2025-13940 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVSS 4.0MEDIUM 5.3
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences