VulnerabilityDeferred

CVE-2025-57820

Svelte devalue is a utility library.

HIGH 7.9EPSS 0.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

CVSS 4.0: 7.9 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-1321
Source: security-advisories@github.com

References

https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132
https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.