SvelteKit CVE-2026-82257

Exploitation requires all three of the following conditions to be true simultaneously in the target application: (1) the application uses SvelteKit's remote form functions feature, (2) the form includes an input field of type 'file', and (3) the application accepts arbitrary user-controlled string values as the path name for that file field without sanitisation or allowlist validation. These are developer implementation choices, not default framework behaviours, meaning most SvelteKit deployments that do not combine all three conditions are not exploitable. What limits exploitation further: the impact is confined to prototype method removal (availability degradation), not code execution or data access; the CVSS 4.0 vector assigns VA:L with no confidentiality or integrity impact; and no scope change affects subsequent systems.

The provided CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores 5.3, indicating medium severity with network reachability, low attack complexity, no privilege requirement, and only low availability impact on the vulnerable system with no subsequent-system impact. Real-world risk is meaningfully lower than the AV:N/PR:N combination might suggest: exploitation requires three simultaneous application-level conditions (remote form functions enabled, a file input field present, and user-controlled path names accepted), none of which are default or universal. The impact is bounded to availability degradation - method removal can break functionality but does not grant code execution, data exfiltration, or integrity modification. No EPSS score was provided, no KEV listing exists, and no public POC has been identified, all consistent with a medium-priority finding. The assigned UI:P in the CVSS 4.0 vector warrants verification; the description implies the attacker submits the form directly rather than requiring passive victim interaction, suggesting UI:N may be more accurate - confirm with the vendor advisory.

An attacker targeting a SvelteKit application that exposes a file upload form backed by a remote form function submits a crafted HTTP multipart request where the file input's path parameter is set to a value that traverses the prototype chain (e.g., __proto__.toString or constructor.prototype.valueOf). The SvelteKit deletion path logic processes this input and removes the targeted method from the prototype, causing subsequent calls to that method across the application to throw errors or silently fail. No authentication is required to submit the form; the attacker needs only to identify a qualifying endpoint.