IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-10-15 18:15

MODIFIED

2025-10-16 15:28

EPSS (Prob. Exploit)

0.73%

Top 45.4%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-hwmc-4c8j-xxj7 HIGH

`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`

AFFECTED PACKAGES:

NPM / sveltekit-superforms

<= 2.27.3

Fixed in: 2.27.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`

AFFECTED PACKAGES:

Unknown / Unknown

46 versions affected

ALIASES:

GHSA-hwmc-4c8j-xxj7

> HISTORIQUE DES MODIFICATIONS

Première apparition

15/10/2025 18:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui