CVE-2026-123568Medium· 4.4▾ SunlitSveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with pollut…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.
devalue < 5.6.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123561Low· 3.7Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
CVE-2026-123567Low· 3.7Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
GHSA-4q55-j62x-fr9hMediumdevalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
CVE-2026-123562High· 7.5Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123564High· 7.5Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-123563High· 7.5Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse