SvelteKit Superforms CVE-2025-62381

The target application must process form submissions through superforms' superValidate()/parseFormData() flow (standard, documented usage), and the endpoint must accept a user-supplied multipart body containing a __superform_json field plus __superform_file_/__superform_files_ path keys - the code path that feeds attacker-controlled property paths and values into setPaths(). Per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and requires no user interaction, so any reachable form endpoint on v2.27.3 or earlier is exposed. LIMITING FACTORS: reliable prototype pollution yields DoS/type confusion against default configurations, but escalation to remote code execution is NOT automatic - it requires a suitable prototype-pollution gadget to exist in the downstream application or its dependencies, which is why the vendor assigned AC:H and AT:P (a non-guaranteed attack requirement).

The vendor-supplied CVSS 4.0 vector (8.3, High) shows AV:N and PR:N/UI:N - network-reachable and unauthenticated - but deliberately tempers this with AC:H and AT:P, signalling that reliable high-severity exploitation carries meaningful complexity and attack requirements. This is consistent with the impact metrics: VA:H (availability) is the one concrete high impact, while VC:L and VI:L (confidentiality/integrity low) reflect that the headline 'RCE' is conditional, not guaranteed. EPSS corroborates a measured risk: 0.55% probability at the 44th percentile is low-to-moderate, indicating no mass exploitation pressure, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A proof-of-concept is documented in the GHSA advisory (showing pollution of Object.prototype.toString), so exploit knowledge is public even though weaponized use is not observed. Net assessment: this is a legitimate patch-promptly issue for internet-exposed SvelteKit applications - prototype pollution reliably yields DoS/type confusion against default usage - but it is not an emergency: RCE depends on downstream gadget chains (reflected in AC:H/AT:P), EPSS is low, there is no KEV listing, and the affected product is a framework-specific library rather than ubiquitous infrastructure.

An unauthenticated attacker submits a crafted multipart form POST to any endpoint that validates input with superforms' superValidate(), embedding a malicious __superform_json payload plus attacker-controlled __superform_file_/__superform_files_ path keys that cause setPaths() to write into Object.prototype. This pollutes shared object state across the Node process, reliably causing denial of service or type confusion, and - in applications containing a suitable gadget - potentially remote code execution. A working proof-of-concept polluting Object.prototype.toString is published in the GHSA advisory.