PT-2026-24756 · Git+3 · Devalue

Jviide · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-30226

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Svelte devalue versions prior to 5.6.4

Description Svelte devalue is a JavaScript library used for serializing values into strings when JSON.stringify is insufficient. Versions 5.6.3 and earlier of devalue.parse and devalue.unflatten are susceptible to prototype pollution through maliciously crafted payloads. Successful exploitation could result in Denial of Service (DoS) or type confusion.

Recommendations Update to version 5.6.4 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-30226

GHSA-CFW5-2VXH-HR84

Affected Products

Devalue

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30226.json · Exploit
• https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30226 · Security Note
• https://osv.dev/vulnerability/GHSA-cfw5-2vxh-hr84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30226 · Vendor Advisory
• https://github.com/sveltejs/devalue · Note
• https://twitter.com/CVEnew/status/2031992398679851459 · Twitter Post