CVE-2026-82257

Published: Ago 28, 2026 Last Modified: Ago 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
Languages: JavaScript
View CWE Details
https://github.com/sveltejs/kit/security/advisories/GHSA-86…
https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x
https://www.vulncheck.com/advisories/sveltekit-before-2.69.…
https://www.vulncheck.com/advisories/sveltekit-before-2.69.1-prototype-pollutio…