CVE-2025-62381
HIGHsveltekit-superforms < 2.27.4 - Prototype Pollution via parseFormData Function
Title source: llmDescription
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7
Scores
CVSS v4
8.3
EPSS
0.0050
EPSS Percentile
38.9%
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-1321
Status
published
Products (2)
ciscoheat/sveltekit-superforms
< 2.27.4
npm/sveltekit-superforms
0 - 2.27.4npm
Published
Oct 15, 2025
Tracked Since
Feb 18, 2026