VYPR
Get started
← All advisories
High severityOSV Advisory· Published Aug 26, 2025· Updated Apr 15, 2026

CVE-2025-57820

CVE-2025-57820

Description

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
devaluenpm
< 5.3.25.3.2

Affected products

1

Patches

2
86a6a66d2c83

Version Packages (#109)

https://github.com/sveltejs/devaluegithub-actions[bot]Aug 26, 2025via osv
commit
4 files changed · +8 −11
  • CHANGELOG.md+7 −0 modified
    @@ -1,5 +1,12 @@
 # devalue changelog
 
+## 5.3.2
+
+### Patch Changes
+
+- 0623a47: fix: disallow array method access when parsing
+- 0623a47: fix: disallow `__proto__` properties on objects
+
 ## 5.3.1
 
 ### Patch Changes
  • .changeset/huge-ads-study.md+0 −5 removed
    @@ -1,5 +0,0 @@
----
-'devalue': patch
----
-
-fix: disallow array method access when parsing
  • .changeset/rich-clouds-walk.md+0 −5 removed
    @@ -1,5 +0,0 @@
----
-'devalue': patch
----
-
-fix: disallow `__proto__` properties on objects
  • package.json+1 −1 modified
    @@ -1,7 +1,7 @@
 {
 	"name": "devalue",
 	"description": "Gets the job done when JSON.stringify can't",
-	"version": "5.3.1",
+	"version": "5.3.2",
 	"repository": "sveltejs/devalue",
 	"sideEffects": false,
 	"exports": {
0623a47c9555

Merge commit from fork

https://github.com/sveltejs/devalueRich HarrisAug 26, 2025via ghsa
commit
4 files changed · +27 −1
  • .changeset/huge-ads-study.md+5 −0 added
    @@ -0,0 +1,5 @@
+---
+'devalue': patch
+---
+
+fix: disallow array method access when parsing
  • .changeset/rich-clouds-walk.md+5 −0 added
    @@ -0,0 +1,5 @@
+---
+'devalue': patch
+---
+
+fix: disallow `__proto__` properties on objects
  • src/parse.js+7 −1 modified
    @@ -44,7 +44,9 @@ export function unflatten(parsed, revivers) {
 		if (index === NEGATIVE_INFINITY) return -Infinity;
 		if (index === NEGATIVE_ZERO) return -0;
 
-		if (standalone) throw new Error(`Invalid input`);
+		if (standalone || typeof index !== 'number') {
+			throw new Error(`Invalid input`);
+		}
 
 		if (index in hydrated) return hydrated[index];
 
@@ -177,6 +179,10 @@ export function unflatten(parsed, revivers) {
 			hydrated[index] = object;
 
 			for (const key in value) {
+				if (key === '__proto__') {
+					throw new Error('Cannot parse an object with a `__proto__` property');
+				}
+
 				const n = value[key];
 				object[key] = hydrate(n);
 			}
  • test/test.js+10 −0 modified
    @@ -681,6 +681,16 @@ const invalid = [
 		name: 'empty array',
 		json: '[]',
 		message: 'Invalid input'
+	},
+	{
+		name: 'prototype pollution',
+		json: '[{"__proto__":1},{}]',
+		message: 'Cannot parse an object with a `__proto__` property'
+	},
+	{
+		name: 'bad index',
+		json: '[{"0":1,"toString":"push"},"hello"]',
+		message: 'Invalid input'
 	}
 ];

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.