Executive brief
sveltekit-superforms is a popular SvelteKit form validation library used to handle user-submitted form data on web applications. A prototype pollution vulnerability allows an attacker to inject malicious properties into JavaScript's Object prototype by submitting specially crafted form data, leading to application crashes, data corruption, or in severe cases remote code execution when downstream libraries (like email services) are used.
Technical details
The vulnerability is a prototype pollution flaw in the parseFormData function of formData.js (sveltekit-superforms versions ≤2.27.3). When processing form submissions, the library deserializes JSON from the __superform_json parameter and then performs nested property assignments using user-controlled keys from form parameters prefixed with __superform_file_ or __superform_files_. Because both the assignment target path and value originate from attacker-controlled input without sanitization, an attacker can craft requests that set properties on Object.prototype (e.g., via __proto__ or constructor.prototype). This pollutes the base prototype for all objects in the application, causing denial of service through method override (e.g., toString) or enabling RCE when gadget chains exist in dependent libraries. The vulnerability requires network access and no authentication, but successful RCE requires a vulnerable library chain (such as nodemailer) in the downstream application. Version 2.27.4 and later include fixes.
Affected products
- sveltekit-superforms sveltekit-superforms <=2.27.3
Timeline
- 2025-10-15: disclosed
- 2025-10-15: patched: Version 2.27.4 released with fix