PT-2026-24756 · Git+3 · Devalue

Jviide · Publicado 2026-03-11 · Atualizado 2026-03-12 · CVE-2026-30226

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Svelte devalue versions prior to 5.6.4

Description Svelte devalue is a JavaScript library used for serializing values into strings when JSON.stringify is insufficient. Versions 5.6.3 and earlier of devalue.parse and devalue.unflatten are susceptible to prototype pollution through maliciously crafted payloads. Successful exploitation could result in Denial of Service (DoS) or type confusion.

Recommendations Update to version 5.6.4 or later.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-30226

GHSA-CFW5-2VXH-HR84

Produtos afetados

Devalue

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30226.json · Exploit
• https://github.com/sveltejs/devalue · Nota
• https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30226 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-cfw5-2vxh-hr84 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031992398679851459 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30226 · Aviso do Fabricante