CVE-2025-57820 - CVE House
Back to Database
Status published High CVE-2025-57820

Svelte devalue vulnerable to prototype pollution

Vulnerability Description

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-57820

Credits & Attribution

No credits recorded in the NVD database.

References

More from sveltejs

View All →
CVE-2025-67647
SvelteKit Denial of service and possible SSRF when using prerendering
High 8.4
CVE-2025-32388
SvelteKit allows XSS via tracked search_params
Medium 5.4
CVE-2024-53262
Unescaped error message included on error page in SvelteKit
Low 2
CVE-2024-53261
Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit
Low 2
CVE-2024-45047
Potential mXSS vulnerability due to improper HTML escaping in svelte
Medium 5.4

Affected Vendor

Affected Software

devalue
Vulnerable Versions:
< 5.3.2

Timeline

Official Publish: August 26th, 2025
Last Modified: August 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.