Executive brief
devalue is a JavaScript library used to serialize and deserialize complex data structures. A prototype pollution vulnerability in the parse() function allows an attacker to inject malicious properties into object prototypes or assign array methods to object properties, potentially bypassing validation logic or corrupting application state.
Technical details
The vulnerability exists in devalue.parse() which fails to properly sanitize input when deserializing strings. Two attack vectors are present: (1) allowing __proto__ to be set on deserialized objects, enabling prototype pollution that can overwrite inherited properties and methods, and (2) allowing non-numeric indices in the payload to assign array prototype methods to arbitrary object properties. Both require only network access and no authentication. An attacker can craft a malicious payload to manipulate object behavior at runtime or bypass server-side validation checks. The vulnerability affects all versions prior to 5.3.2.
Affected products
- Svelte devalue < 5.3.2
Timeline
- 2025-08-26: disclosed
- 2025-08-26: patched: version 5.3.2