{"id":"GHSA-866w-xmhq-wj7x","revision":"4e571326a39642feb718fdfdb490a32f","records":[{"revision":"4e571326a39642feb718fdfdb490a32f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-866w-xmhq-wj7x","aliases":["CVE-2026-82257"],"title":"SvelteKit: Prototype pollution in file input deletion path in remote-function forms","description":"If you use remote form functions, have an input field of type `file`, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.","state":0,"publishedAt":"2026-07-24T15:58:05+00:00","modifiedAt":"2026-08-29T03:55:36.2053887+00:00","affected":[{"ecosystem":"npm","name":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.69.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x","https://github.com/sveltejs/kit/pull/16218","https://github.com/sveltejs/kit/commit/df32f6fe86cdd0b68b650e3e4631e5896453dcd3","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7"],"sourceUrl":"https://github.com/advisories/GHSA-866w-xmhq-wj7x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-866w-xmhq-wj7x","identifiers":["GHSA-866w-xmhq-wj7x","CVE-2026-82257"]},"retained":false,"historicalAffected":[]}],"coverage":[]}