High severityOSV Advisory· Published Aug 26, 2025· Updated Apr 15, 2026
CVE-2025-57820
CVE-2025-57820
Description
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
devaluenpm | < 5.3.2 | 5.3.2 |
Affected products
2Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.