---
id: CVE-2026-123568
title: Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
summary: >-
  Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability
  that allows attackers to alter object prototypes by supplying untrusted data
  to uneval. When the generated code is later evaluated, it creates objects with
  pollut…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-1321
vendor: sveltejs
product: devalue
affected:
  - devalue < 5.6.3
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:06.526Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123568'
references:
  - url: >-
      https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r
    label: GitHub Security Advisory (GHSA-8qm3-746x-r74r)
  - url: >-
      https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.3-prototype-pollution-via-uneval-output
    label: >-
      VulnCheck Advisory: Sveltejs devalue before 5.6.3 Prototype Pollution via
      uneval Output
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.659Z'
---

## Overview

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

## Affected

- `devalue < 5.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.