PT-2025-42389 · Unknown · Sveltekit-Superforms

Published 2025-10-15 · Updated 2025-10-18 · CVE-2025-62381

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions sveltekit-superforms versions prior to 2.27.4

Description The software, sveltekit-superforms, has an issue where the parseFormData function in formData.js is susceptible to prototype pollution. An attacker can inject properties into Object.prototype, potentially leading to denial of service, type confusion, and remote code execution in applications that use polluted objects. The vulnerable function is parseFormData().

Recommendations Update to version 2.27.4 or later.

Exploit

Fix

DoS

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-62381

GHSA-HWMC-4C8J-XXJ7

Affected Products

Sveltekit-Superforms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62381.json · Exploit
• 🔥 https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62381 · Security Note
• https://osv.dev/vulnerability/GHSA-hwmc-4c8j-xxj7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62381 · Vendor Advisory
• https://github.com/ciscoheat/sveltekit-superforms · Note
• https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4 · Note
• https://twitter.com/CVEnew/status/1978545026306318443 · Twitter Post
• https://t.me/CVEtracker/35033 · Telegram Post
• https://twitter.com/SecAideInfo/status/1979490934992597401 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post