CVE-2026-82257 json
SvelteKit before 2.69.1 Prototype Pollution via File Input
published 4mo ago modified last mo. also EUVD-2026-67583 , GHSA-866w-xmhq-wj7x
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.
Patch / fix
- npm @sveltejs/kit 2.69.1
- sveltejs kit 2.69.1
Is CVE-2026-82257 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @sveltejs/kit | <2.69.1 |
2.69.1 |
Affected products
- sveltejs kit
Classification
- Weakness
-
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
References
-
github.com
/sveltejs/kit/pull/16218
web
-
github.com
/sveltejs/kit/commit/df32f6fe86cdd0b68b650e3e4631e5896453dcd3
web
-
github.com
/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/sveltekit-before-2.69.1-prototype-pollution-via-file-input
third-party-advisory
-
github.com
/sveltejs/kit
package
-
github.com
/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1
web
-
github.com
/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7
web
Sources
- CVE List CVE-2026-82257
- GitHub Advisory GHSA-866w-xmhq-wj7x
- NVD CVE-2026-82257
- Maintainer advisory GHSA-866w-xmhq-wj7x
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of sveltejs/kit published their own advisory on GitHub. Reviewed sources take precedence over it.