Prototype Pollution Vulnerability in Svelte.js devalue Product
CVE-2026-123561

6.3MEDIUM

Key Information:

Vendor

Sveltejs

Status
Devalue
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123561?

The Svelte.js devalue product versions before 5.9.3 are susceptible to a prototype pollution vulnerability. This issue arises from malformed null-prototype object keys that can bypass the proto rejection process through property-key coercion, leading to potential security exploits. Attackers can leverage crafted payloads to generate objects with an proto own property. Although previous fixes attempted to address this vulnerability, it remains partially unresolved, posing risks to applications utilizing this product.

Affected Version(s)

devalue 0 < 5.9.3

devalue 5.9.3

References

https://github.com/sveltejs/devalue/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/sveltejs-devalue-bef...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elliott-with-the-longest-name-on-github
.