CVE-2026-123568
Received Received - Intake

Prototype Pollution in Sveltejs Devalue

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123568
EUVD
EUVD-2026-119453

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sveltejs devalue 5.6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Sveltejs devalue before 5.6.3 has a prototype pollution flaw in the uneval function. Attackers can manipulate object prototypes by providing malicious untrusted input. When the affected code is later evaluated, it generates objects with polluted prototypes, causing the output data structure to differ from the original input.

Impact Analysis

This vulnerability could allow attackers to alter application behavior by modifying object prototypes. It may lead to unexpected data processing, security bypasses, or unintended code execution depending on how the affected library is used in applications.

Mitigation Strategies

Upgrade devalue to version 5.6.3 or later to address the prototype pollution vulnerability. Review code using uneval for untrusted data inputs and validate or sanitize all external data before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...