Dashboard / CVE-2026-123568

CVE-2026-123568

LOW
INFO Priority: 0.00 BB Relevance: 39/100
Published: 2026-11-08 Modified: 2026-11-12 First seen: 2026-11-08 Status: active

Attack Surface

Network No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: X
AT: Present
VC: Low
VI: Low
VA: None

Description

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
sveltejs devalue 0 < 5.6.3
sveltejs devalue 0 < 5.6.3

References & Advisories (2)

Bug Bounty Relevance

39 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.20%
Raw Score 0.002020
Percentile 10.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00202
2026-11-12
0.00202
2026-11-10
0.00202
2026-11-09
0.00202
2026-11-08
0.00202

Intelligence Sources

mitre ref →
nvd ref →

External Links