Dummdidumm

**Name of the Vulnerable Software and Affected Versions** SvelteKit versions prior to 2.69.1 **Description** Remote form functions with file input fields that accept arbitrary user-controlled path names are susceptible to prototype pollution. This occurs when an attacker manipulates the deletion path to remove methods on the prototype, which can lead to the disabling of application functionality. Prototype pollution is a technique where an attacker modifies the base prototype of an object, affecting all objects derived from it. **Recommendations** Update to version 2.69.1 or later.

**Name of the Vulnerable Software and Affected Versions** SvelteKit versions 2.38.0 through 2.60.0 **Description** A race condition exists in the `query.batch` function. This flaw allows concurrent requests from different users to merge under a single request context, enabling attackers to exploit specific timing conditions to access sensitive data from other users' concurrent requests. **Recommendations** Update SvelteKit to version 2.60.1 or later.