GHSA-8qm3-746x-r74r

GHSA-8qm3-746x-r74r · devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`ed, meaning the output data can be a different shape from the input data.

CVSS 2.1 · Low · Fix available

Published: 2026-02-19T20:29:17Z
Updated: 2026-02-22T23:43:48.066457Z

Stack: node

Affected products and versions

devalue npm
Affected ranges
- SEMVER: < 5.6.3
Update to 5.6.3

Original sources

https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r
https://github.com/sveltejs/devalue/commit/0f04d4d678eac39ad5d7a07d1956275d7874e81c
https://github.com/sveltejs/devalue
https://github.com/sveltejs/devalue/releases/tag/v5.6.3
https://osv.dev/vulnerability/GHSA-8qm3-746x-r74r

Check your server →

GHSA-8qm3-746x-r74r · devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Affected products and versions

devalue npm

Original sources