GHSA-866w-xmhq-wj7x

Summary

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

Severity

medium

CVSS

4.3

CWE

CWE-1321

Published

2026-07-24

Updated

2026-07-24

Advisory details

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

References

• https://github.com/advisories/GHSA-866w-xmhq-wj7x
• https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x
• https://github.com/sveltejs/kit/pull/16218
• https://github.com/sveltejs/kit/commit/df32f6fe86cdd0b68b650e3e4631e5896453dcd3
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7

Related advisories

• CVE-2026-40073 — high · npm/@sveltejs/kit
• CVE-2026-66062 — medium · npm/@sveltejs/kit
• GHSA-wqjv-9729-c5q2 — medium · npm/@sveltejs/kit
• GHSA-hgv7-v322-mmgr — medium · npm/@sveltejs/kit
• CVE-2026-40074 — medium · npm/@sveltejs/kit
• CVE-2026-105857 — critical · npm/@payloadcms/plugin-form-builder
• CVE-2026-105844 — critical · npm/@payloadcms/plugin-import-export
• CVE-2026-104848 — critical · npm/tinypool

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity