CVE-2025-62381highCWE-1321

CVE-2025-62381: falha de alta gravidade em ciscoheat sveltekit-superforms

sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`

Publicada em

Seguir esta CVE+ Monitorar sveltekit-superforms+ Monitorar sveltekit-superforms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.7%
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L
Produtos afetados
ciscoheat · sveltekit-superforms