{"id":"CVE-2025-57820","aliases":["CLSA-2026-1774398079","CLSA-2026-1786357331","EUVD-2025-25863","GHSA-33hq-fvwr-56pm","GHSA-8qm3-746x-r74r","GHSA-mwv9-gp5h-frr4","GHSA-vj54-72f3-p5jv","ROOT-APP-NPM-CVE-2025-57820"],"status":"published","title":"Svelte devalue vulnerable to prototype pollution","description":"Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2","severity":{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00369,"percentile":0.31286,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2025-08-26T22:33:14Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"npm","package":"devalue","fixed_in":["5.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"devalue","fixed_in":["4.3.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/devalue","fixed_in":["4.3.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"devalue","fixed_in":["4.3.3-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.3-tuxcare.0"},{"fixed":"4.3.3-tuxcare.1"}]}],"versions":["4.3.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-tuxcare.0"},{"fixed":"4.3.2-tuxcare.1"}]}],"versions":["4.3.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.3.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-aikido.1"}]}]}],"products":[{"vendor":"sveltejs","product":"devalue"}],"references":[{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57820","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vj54-72f3-p5jv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57820.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-57820","title":"Svelte devalue vulnerable to prototype pollution","description":"Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2","status":"published","published":"2025-08-26T22:33:19.1Z","modified":"2025-08-27T20:42:46.786Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-25863","description":"Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2","status":"published","published":"2025-08-26T22:33:19Z","modified":"2025-08-27T20:42:46Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T20:31:51.141859Z"}],"ghsa":[{"id":"GHSA-vj54-72f3-p5jv","title":"devalue prototype pollution vulnerability","description":"## 1. `devalue.parse` allows `__proto__` to be set\n\nA string passed to `devalue.parse` could represent an object with a `__proto__` property, which would assign a prototype to an object while allowing properties to be overwritten:\n\n```js\nclass Vector {\n  constructor(x, y) {\n    this.x = x;\n    this.y = y;\n  }\n\n  get magnitude() {\n    return (this.x ** 2 + this.y ** 2) ** 0.5;\n  }\n}\n\nconst payload = `[{\"x\":1,\"y\":2,\"magnitude\":3,\"__proto__\":4},3,4,\"nope\",[\"Vector\",5],[6,7],8,9]`;\n\nconst vector = devalue.parse(payload, {\n  Vector: ([x, y]) =\u003e new Vector(x, y)\n});\n\nconsole.log(\"Is vector\", vector instanceof Vector); // true\nconsole.log(vector.x) // 3\nconsole.log(vector.y) // 4\nconsole.log(vector.magnitude); // \"nope\" instead of 5\n```\n\n## 2. `devalue.parse` allows array prototype methods to be assigned to object\n\nIn a payload constructed with `devalue.stringify`, values are represented as array indices, where the array contains the 'hydrated' values:\n\n```js\ndevalue.stringify({ message: 'hello' }); // [{\"message\":1},\"hello\"]\n```\n\n`devalue.parse` does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:\n\n```js\nconst object = devalue.parse('[{\"toString\":\"push\"}]');\nobject.toString(); // 0\n```\n\nThis could be used by a creative attacker to bypass server-side validation.","status":"published","published":"2025-08-26T22:33:14Z","modified":"2025-08-27T14:27:09Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-57820","description":"Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2","status":"published","published":"2025-08-26T23:15:35.73Z","modified":"2026-06-17T09:43:29.903Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"CVE-2025-57820","title":"Svelte devalue vulnerable to prototype pollution","description":"Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2","status":"published","published":"2025-08-26T22:33:19.1Z","modified":"2026-10-28T02:30:29.719361007Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-vj54-72f3-p5jv","title":"devalue prototype pollution vulnerability","description":"## 1. `devalue.parse` allows `__proto__` to be set\n\nA string passed to `devalue.parse` could represent an object with a `__proto__` property, which would assign a prototype to an object while allowing properties to be overwritten:\n\n```js\nclass Vector {\n  constructor(x, y) {\n    this.x = x;\n    this.y = y;\n  }\n\n  get magnitude() {\n    return (this.x ** 2 + this.y ** 2) ** 0.5;\n  }\n}\n\nconst payload = `[{\"x\":1,\"y\":2,\"magnitude\":3,\"__proto__\":4},3,4,\"nope\",[\"Vector\",5],[6,7],8,9]`;\n\nconst vector = devalue.parse(payload, {\n  Vector: ([x, y]) =\u003e new Vector(x, y)\n});\n\nconsole.log(\"Is vector\", vector instanceof Vector); // true\nconsole.log(vector.x) // 3\nconsole.log(vector.y) // 4\nconsole.log(vector.magnitude); // \"nope\" instead of 5\n```\n\n## 2. `devalue.parse` allows array prototype methods to be assigned to object\n\nIn a payload constructed with `devalue.stringify`, values are represented as array indices, where the array contains the 'hydrated' values:\n\n```js\ndevalue.stringify({ message: 'hello' }); // [{\"message\":1},\"hello\"]\n```\n\n`devalue.parse` does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:\n\n```js\nconst object = devalue.parse('[{\"toString\":\"push\"}]');\nobject.toString(); // 0\n```\n\nThis could be used by a creative attacker to bypass server-side validation.","status":"published","published":"2025-08-26T22:33:14Z","modified":"2025-08-27T14:27:08Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"CLSA-2026-1774398079","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:02.092446207Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1786357331","title":"TuxCare security update for devalue (5 CVEs)","description":"TuxCare rebuilt devalue to address 5 CVEs. Fixed in 4.3.2-tuxcare.1.","status":"published","published":"2026-08-10T10:22:11Z","modified":"2026-10-15T09:45:59.437400095Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"ROOT-APP-NPM-CVE-2025-57820","title":"CVE-2025-57820 in @rootio/devalue - Patched by Root","description":"Root has patched CVE-2025-57820 in the @rootio/devalue package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-08T10:52:37Z","modified":"2026-07-08T13:00:06.747769868Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}