CVE-2026-82257

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.69.1

Description Remote form functions with file input fields that accept arbitrary user-controlled path names are susceptible to prototype pollution. This occurs when an attacker manipulates the deletion path to remove methods on the prototype, which can lead to the disabling of application functionality. Prototype pollution is a technique where an attacker modifies the base prototype of an object, affecting all objects derived from it.

Recommendations Update to version 2.69.1 or later.