Sveltekit
Monthly
Prototype pollution in sveltekit-superforms 2.27.3 and earlier allows unauthenticated remote attackers to inject string and array properties into Object.prototype by submitting crafted multipart form data to any endpoint that parses forms via superValidate(). The vendor-supplied CVSS 4.0 score is 8.3 (High) with AV:N and PR:N/UI:N but tempered by AC:H and AT:P, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) reflects the same trade-off: reliable pollution yields denial of service and type confusion against default configurations, while escalation to remote code execution is not automatic and depends on a suitable prototype-pollution gadget in the downstream application or its dependencies. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.55%, 44th percentile), and a vendor patch is available in 2.27.4.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The SvelteKit framework offers developers an option to create simple REST APIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
SvelteKit is a web development framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Prototype pollution in sveltekit-superforms 2.27.3 and earlier allows unauthenticated remote attackers to inject string and array properties into Object.prototype by submitting crafted multipart form data to any endpoint that parses forms via superValidate(). The vendor-supplied CVSS 4.0 score is 8.3 (High) with AV:N and PR:N/UI:N but tempered by AC:H and AT:P, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) reflects the same trade-off: reliable pollution yields denial of service and type confusion against default configurations, while escalation to remote code execution is not automatic and depends on a suitable prototype-pollution gadget in the downstream application or its dependencies. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.55%, 44th percentile), and a vendor patch is available in 2.27.4.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The SvelteKit framework offers developers an option to create simple REST APIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
SvelteKit is a web development framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.