High, CVSS 8.3npmAmendedPublished
sveltekit-superforms has Prototype Pollution in parseFormData function of formData.js
CVE-2025-62381 · GHSA-hwmc-4c8j-xxj7
- Affected
- npm sveltekit-superforms <= 2.27.3
- Fixed in
- 2.27.4· Vendor fix available
- Issue
- sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. Details Superforms is a SvelteKit form library for server and client form validation. Under normal operation, form validation is performed by calling the the superValidate function, with the submitted form data and a form schema as arguments: Within the superValidate function, a call is made to parseRequest in order to parse the user's input. parseRequest then calls into parseFormData, which in turn looks for the presence of superformjson in the form parameters. If superformjson is present, the following snippet is executed: This snippet deserializes JSON input within the superformjson, and then performs a nested assignment…
Recommended action: Upgrade to 2.27.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.