CVE-2026-123568 · Package
NO FIX YET · SEE WHAT TO DO
devalue, a Svelte serialization library, is vulnerable to prototype pollution when untrusted data is passed to its uneval function. When the generated code is later evaluated, objects get polluted prototypes and produce output whose shape differs from the input.
first public Feb 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that pass untrusted data to devalue's uneval and then evaluate the generated code are exposed. Projects that only serialize trusted data or do not use uneval with untrusted input can likely skip it.
Not affected if no-uneval-usage, trusted-data-only
Who cares javascript, npm, svelte, sveltekit
npm ls devalue in each project.5.6.3.uneval and its output is evaluated.5.6.3 or laterSveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.