Home > Vulnerability Database > CVE-2025-57820

Mend.io Vulnerability Database

CVE-2025-57820

Good to know:

Date: August 26, 2025

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a proto property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Severity Score

0.0

Related Resources (5)

Url: https://github.com/sveltejs/devalue

Url: https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-57820

Url: https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132

Url: https://www.mend.io/vulnerability-database/CVE-2025-57820

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version devalue - 5.3.2;https://github.com/sveltejs/devalue.git - v5.3.2

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE