Description
sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects.
Recommendation
Update the sveltekit-superforms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.27.3
- Patched version(s): 2.27.4
References
Could your website be exposed too?
SmartScanner can check your website for `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CSVTOJSON has a prototype pollution vulnerability - CVE-2025-57350
- tRPC has possible prototype pollution in `experimental_nextAppDirCaller` - CVE-2025-68130
- Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd - CVE-2025-13465
- billboard.js allows prototype pollution via the function generate - CVE-2025-49223
You might also like:
See something that needs correcting? Let us knowUpdated October 15, 2025