Executive brief
Svelte's devalue library converts JavaScript objects into a serialized string representation. When that serialized code is later evaluated, it can create objects with polluted prototypes under certain circumstances, causing the restored object to have a different structure than the original. This allows an attacker to inject malicious properties into the prototype chain, potentially affecting all objects derived from that prototype.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the devalue library's `uneval` function. When untrusted data is serialized via `uneval`, the generated output code can, under certain circumstances, create objects with polluted prototypes when later evaluated. The attack requires the output of `uneval` to be passed through `eval`, high privileges, and certain special conditions to trigger. An attacker exploiting this can alter the prototype chain of deserialized objects, allowing injection of properties that affect subsequent object operations. The fix is available in version 5.6.3, which properly handles `__proto__` pollution.
Affected products
- Svelte devalue <= 5.6.2
Timeline
- 2026-02-19: disclosed: Advisory GHSA-8qm3-746x-r74r published
- 2026-02-19: patched: Fix released in version 5.6.3