CVE-2026-30226

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30226", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.797Z", "datePublished": "2026-03-11T17:47:40.016Z", "dateUpdated": "2026-03-12T13:51:34.208Z"}, "containers": {"cna": {"title": "devalue has prototype pollution in devalue.parse and devalue.unflatten", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84"}], "affected": [{"vendor": "sveltejs", "product": "devalue", "versions": [{"version": "< 5.6.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:47:40.016Z"}, "descriptions": [{"lang": "en", "value": "Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4."}], "source": {"advisory": "GHSA-cfw5-2vxh-hr84", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T13:51:27.760058Z", "id": "CVE-2026-30226", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:51:34.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30226", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T13:51:27.760058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:51:30.426Z"}}], "cna": {"title": "devalue has prototype pollution in devalue.parse and devalue.unflatten", "source": {"advisory": "GHSA-cfw5-2vxh-hr84", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "sveltejs", "product": "devalue", "versions": [{"status": "affected", "version": "< 5.6.4"}]}], "references": [{"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84", "name": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:47:40.016Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30226", "state": "PUBLISHED", "dateUpdated": "2026-03-12T13:51:34.208Z", "dateReserved": "2026-03-04T17:23:59.797Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T17:47:40.016Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "devalue", "vendor": "sveltejs", "versions": [{"status": "affected", "version": "< 5.6.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7B79C1C5-18D6-46E6-B142-6344E236D7B9", "versionEndExcluding": "5.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4."}, {"lang": "es", "value": "Svelte devalue es una biblioteca JavaScript que serializa valores en cadenas cuando JSON.stringify no es suficiente para la tarea. En devalue v5.6.3 y anteriores, devalue.parse y devalue.unflatten eran susceptibles a la contaminaci\u00f3n de prototipos a trav\u00e9s de cargas \u00fatiles creadas maliciosamente. La explotaci\u00f3n exitosa podr\u00eda conducir a denegaci\u00f3n de servicio (DoS) o confusi\u00f3n de tipos. Esta vulnerabilidad est\u00e1 corregida en 5.6.4."}], "id": "CVE-2026-30226", "lastModified": "2026-06-17T10:32:31.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30226", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T13:51:27.760058Z", "version": "2.0.3"}}]}, "published": "2026-03-11T18:16:22.937", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "devalue: Devalue: Denial of Service or type confusion via prototype pollution", "id": "2446675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446675"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in the Svelte devalue JavaScript library. A remote attacker could exploit a prototype pollution vulnerability by sending maliciously crafted payloads to the devalue.parse or devalue.unflatten functions. Successful exploitation of this flaw could lead to a Denial of Service (DoS) condition, making the affected system unavailable, or result in type confusion, which could have further unpredictable impacts."], "name": "CVE-2026-30226", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:0", "fix_state": "Not affected", "package_name": "rhdesktop/rh-podman-desktop-ext-bootc-rhel10", "product_name": "Red Hat Build of Podman Desktop - Tech Preview"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Not affected", "package_name": "rhtas/rekor-search-ui-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}], "public_date": "2026-03-11T17:47:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-30226\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30226\nhttps://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.6.4)"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "devalue", "source": "cna", "vendor": "sveltejs"}, "product": "devalue", "vendor": "svelte"}], "analysis": {"en": {"generated_at": "2026-03-17T20:44:01.911749+00:00", "value": {"mitigation_remediation": ["Upgrade sveltejs devalue to version 5.6.4 or later", "Validate or sanitize any data before passing to devalue.parse or devalue.unflatten if upgrade is not feasible"], "summary": {"action": "Patch", "impact": "Denial of Service / Type Confusion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Svelte JavaScript library devalue, specifically versions v5.6.3 and all earlier releases. The affected package is identified by the CPE cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*. Users employing these versions should consider upgrading to a patched release.", "description_and_impact": "Prototype pollution vulnerability in Svelte devalue\u2019s parse and unflatten functions allows maliciously crafted payloads to overwrite objects on the prototype chain. This can result in denial of service by breaking the library\u2019s logic or type confusion that may lead to incorrect type handling within applications that rely on devalue for serialization and deserialization. The weakness is identified as CWE-1321 (Prototype Pollution) and CWE-843 (Type Confusion).", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The CVE is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, further implying limited active exploitation. A potential attacker would need to deliver a specially crafted payload to devalue.parse or devalue.unflatten, which typically involves JavaScript code execution within a Node.js environment or a front\u2011end application that uses devalue. The risk can be mitigated by applying the vendor\u2019s patch or by restricting the use of these functions to trusted input only."}}}}, "created": "2026-03-12T09:57:32.918588+00:00", "updated": "2026-03-20T15:30:10.495408+00:00", "vendors": ["svelte", "svelte$PRODUCT$devalue"]}