Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-57820: GitHub Actions devalue allows prototype pollution
CVE-2025-57820 · published 1 year ago
Summary
The devalue library used in GitHub Actions could be fooled by a crafted string to change the internal structure of objects. This can let an attacker subtly alter how the code works, potentially leading to security issues. Update devalue to version 5.3.2 or newer to fix the problem.
What to do
- Update GitHub Actions devalue to version 5.3.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | devalue |
< 5.3.2 Fix: upgrade to 5.3.2
|
Original advisory text
Svelte devalue vulnerable to prototype pollution
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2
References
- https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv Vendor Advisory
- https://github.com/advisories/GHSA-vj54-72f3-p5jv
- https://nvd.nist.gov/vuln/detail/CVE-2025-57820 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57820... Vendor Advisory
- https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-1321Prototype Pollution
Timeline
Published26 Aug 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta