{"action":"Upgrade devalue to 5.9.3 or later.","affected":[{"fixed":"5.9.3","introduced":"0"}],"component":"devalue","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.9.3"],"ghsa_id":"GHSA-mcm9-63f2-9j32","id":"tcs_01M5KG0FT6Q3EKSB0SFDKCHZ8Y","modified_at":"2026-10-01T15:30:12.676095253Z","published_at":"2026-10-01T15:17:29Z","references":["https://osv.dev/vulnerability/GHSA-mcm9-63f2-9j32","https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32","https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463","https://github.com/sveltejs/devalue","https://github.com/sveltejs/devalue/releases/tag/v5.9.3"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-mcm9-63f2-9j32","url":"https://osv.dev/vulnerability/GHSA-mcm9-63f2-9j32"}],"summary":"devalue: Repeated primitive strings cause quadratic expansion in uneval"}