Sveltejs Devalue before version 5.6.3 contains a prototype pollution weakness that allows an attacker to supply untrusted data to the uneval function. The generated JavaScript code is later evaluated, creating objects whose prototypes have been altered. This manipulation changes the shape of objects and can lead to unexpected program behavior or exposure of hidden data. The weakness is scored a CVSS score of 2.1, indicating a low severity impact.

Any deployment that uses the sveltejs:devalue library older than 5.6.3 is affected. Projects that call the uneval routine with data that originates from external or untrusted sources may be vulnerable, as the polluted prototypes will persist when the generated code is executed.

The CVSS score of 2.1 indicates a low overall risk, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not provided, so the probability of exploitation is not measured. Based on the description, the likely attack vector is through an application or module that accepts untrusted data, passes it to uneval, and later evaluates the resulting code. Successful exploitation requires only the ability to supply arbitrary input to uneval and does not need elevated privileges, but the resulting prototype pollution can impact application logic. The risk remains low, but developers should consider if the contamination of prototypes could compromise sensitive functionality in their specific use case.