AIKIDO-2025-10718
sveltekit-superforms is vulnerable to Prototype Pollution
70
High Risk
This Affects:
sveltekit-superformsTL;DR
Affected versions of this package are vulnerable to prototype pollution when using dataType: 'json'. This vulnerability enables an attacker to inject malicious properties into object prototypes by crafting JSON input that includes __proto__, potentially leading to security issues, including remote code execution or denial of service. Before the fix, an attacker could exploit this by sending specially designed data that pollutes the prototype chain, potentially altering the behavior of all objects in the application and enabling further attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
sveltekit-superforms is vulnerable to Prototype Pollution in versions 2.0.0 - 2.27.3.
How to fix this
Upgrade the sveltekit-superforms library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant