Prototype Pollution Vulnerability in SvelteKit Forms by Ciscoheat
CVE-2025-62381

8.3HIGH

Key Information:

Vendor

Ciscoheat

Status
Sveltekit-superforms
Vendor
CVE Published:
15 October 2025

What is CVE-2025-62381?

The SvelteKit forms package, sveltekit-superforms, is vulnerable to a prototype pollution issue due to improper handling in the parseFormData function of formData.js. This vulnerability allows attackers to inject malicious string and array properties into the global Object.prototype. As a result, downstream applications using these polluted objects may face various risks, including denial of service, type confusion, and potential remote code execution. Users are strongly advised to upgrade to version 2.27.4 or later to mitigate these risks.

Affected Version(s)

sveltekit-superforms < 2.27.4

References

https://github.com/ciscoheat/sveltekit-superforms/securit...
x_refsource_CONFIRM
https://github.com/ciscoheat/sveltekit-superforms/commit/...
x_refsource_MISC

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-62381 : Prototype Pollution Vulnerability in SvelteKit Forms by Ciscoheat