CVE-2026-123568

The Sveltejs devalue library, in versions prior to 5.6.3 , is vulnerable to a prototype pollution vulnerability (CWE-1321). An attacker can supply untrusted data to the uneval function to alter object prototypes. When the resulting code is subsequently evaluated, it creates objects with polluted ...

CVE-2026-123567

Versions of Sveltejs devalue prior to 5.6.4 are vulnerable to a prototype injection flaw. The root cause is that the devalue.parse and devalue.unflatten functions allow attackers to inject proto own properties into returned objects. If downstream code merges these results using Object.assign , ...

CVE-2026-123564

Sveltejs devalue versions 1.0.0 through before 5.9.3 contain a memory exhaustion flaw within the uneval component. The issue occurs because the generated code for sparse arrays allocates memory proportional to the array's declared length upon evaluation. An attacker capable of influencing a very ...