CVE-2026-82257

Analyzed Analyzed - Analysis Complete

Prototype Pollution in SvelteKit Remote Forms

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82257

EUVD

EUVD-2026-67583

Affected Vendors & Products

Vendor	Product	Version / Range
svelte	sveltekit	to 2.69.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

SvelteKit versions before 2.69.1 have a prototype pollution flaw in remote form functions that handle file inputs. Attackers can exploit this by providing malicious path names to manipulate the deletion path, potentially removing methods from the prototype and disrupting application functionality.

Detection Guidance

Detecting this vulnerability requires checking if your SvelteKit version is before 2.69.1. Run: npm list sveltekit. If the version is below 2.69.1, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to disable parts of an application by tricking it into deleting critical prototype methods. This may lead to crashes, unexpected behavior, or loss of functionality for users relying on the affected system.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily affects application functionality through prototype pollution. However, if the affected application processes sensitive data under these regulations, the loss of functionality could indirectly lead to compliance issues by disrupting data processing or security controls.

Mitigation Strategies

Upgrade SvelteKit to version 2.69.1 or later immediately. Use: npm update sveltekit. Review form inputs handling file uploads to ensure path names are validated and sanitized.

Hi! I’m here to help you understand CVE-2026-82257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70