Prototype Pollution Vulnerability in Sveltejs devalue by Svelte
CVE-2026-123568

2.1LOW

Key Information:

Vendor

Sveltejs

Status
Devalue
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123568?

Sveltejs devalue before version 5.6.3 features a significant prototype pollution vulnerability. This occurs when untrusted data is supplied to the uneval function, enabling attackers to modify object prototypes. Consequently, code evaluated later may yield objects whose prototype has been tampered with, leading to unexpected data structures and behavior. Users are advised to upgrade to version 5.6.3 or later to mitigate this issue.

Affected Version(s)

devalue 0 < 5.6.3

devalue 5.6.3

References

https://github.com/sveltejs/devalue/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/sveltejs-devalue-bef...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elliott-with-the-longest-name-on-github
.