{"id":"EUVD-2026-67583","enisaUuid":"cfe593b5-4c66-3d21-acb8-01f4ac6677bf","description":"SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.","datePublished":"Aug 28, 2026, 10:49:41 AM","dateUpdated":"Oct 8, 2026, 3:25:29 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.69.1-prototype-pollution-via-file-input\n","aliases":"CVE-2026-82257\nGHSA-6mgf-42wv-8j7p\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"5883c1a4-795f-3d65-98b6-8cccf4b302ad","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"0 \u003c2.69.1"}],"enisaIdVendor":[{"id":"13f3abb6-09e1-3950-bb7e-e2ef159f8181","vendor":{"name":"sveltejs"}}],"enisaIdVulnerability":[{"id":"a157765d-3551-3579-b1bd-5a1b7b44c381","vulnerability":{"id":"GHSA-6mgf-42wv-8j7p","description":"SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.","datePublished":"Aug 28, 2026, 12:30:29 PM","dateUpdated":"Aug 28, 2026, 12:30:29 PM","baseScore":0.0,"references":"https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82257\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.69.1-prototype-pollution-via-file-input\n","enisa_id":"EUVD-2026-67583\n","aliases":"GHSA-6mgf-42wv-8j7p\nCVE-2026-82257\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e7d13f4c-4c38-3bd8-b4bd-3983742bd21d","vulnerability":{"id":"CVE-2026-82257","description":"SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.","datePublished":"Aug 28, 2026, 10:49:41 AM","dateUpdated":"Oct 8, 2026, 3:25:29 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x\nhttps://www.vulncheck.com/advisories/sveltekit-before-2.69.1-prototype-pollution-via-file-input\n","enisa_id":"EUVD-2026-67583\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Nov 9, 2026, 3:06:41 PM","vulnerabilityProduct":[{"id":"ac76eb8f-343d-3143-af6f-fbd9bfcf0612","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"0 \u003c2.69.1"}],"vulnerabilityVendor":[{"id":"03ee58a4-f579-3153-80f4-2f658b6688ba","vendor":{"name":"sveltejs"}}]}}],"enisaIdAdvisory":[]}