PT-2026-22530 · Npm · Devalue

Published 2026-02-19 · Updated 2026-02-19

OSV

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can be a different shape from the input data.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

GHSA-8QM3-746X-R74R

Affected Products

Devalue

References · 5

• https://osv.dev/vulnerability/GHSA-8qm3-746x-r74r · Vendor Advisory
• https://github.com/sveltejs/devalue · Note
• https://github.com/sveltejs/devalue/commit/0f04d4d678eac39ad5d7a07d1956275d7874e81c · Note
• https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r · Note
• https://github.com/sveltejs/devalue/releases/tag/v5.6.3 · Note