The vulnerability manifests when devalue.parse or devalue.unflatten processes crafted serialized input. It allows attackers to inject properties onto the __proto__ object, effectively altering the prototype chain of the objects returned by the library. This prototype pollution can affect any subsequent use of these objects, such as when code merges them with Object.assign. The primary impact is the manipulation of object prototypes that may lead to unexpected behavior or compromise in code that relies on consistent prototypes. The weakness is classified as CWE-1321.

The affected product is the devalue library maintained by the sveltejs project. Versions prior to 5.6.4 are vulnerable. Applications that import devalue before this release and process untrusted or user‑supplied data are at risk. The vendor’s product name is devalue, and any project using this library should check the installed version.

The CVSS v3 score of 6.3 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must provide forged serialized input to devalue.parse or devalue.unflatten, and the impact will materialize when downstream code merges the resulting object with Object.assign or similar operations that propagate the polluted __proto__ properties. Because prototype pollution can lead to more serious effects depending on application logic, the risk escalates in contexts where the application trusts the returned object chain. Overall, the exploitation likelihood is moderate given the lack of publicly known exploitability data.