CVE-2026-30226

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302275.3MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as CVE-2026-302284.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-al CVE-2026-302297.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-al CVE-2026-30238.8Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-CVE-2026-302307.5Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail e CVE-2026-302315.3Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and dir CVE-2026-302329.6Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.CVE-2026-302334.3OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allow CVE-2026-302346.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permi CVE-2026-302356.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation CVE-2026-302364.3OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor CVE-2026-302376.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is