# CVE-2026-82257: SvelteKit prototype pollution in file input deletion

Source: https://junglewise.ai/threats/cve-2026-82257-sveltekit-prototype-pollution-in-file-input-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82257 · Severity: medium · CVSS 4.3 · Published 2026-08-28

SvelteKit is a popular framework for building web applications with Svelte. When using remote form functions with file inputs, an attacker can supply a malicious file input name (e.g., containing "__proto__") to manipulate JavaScript object prototypes, potentially removing methods and disrupting application functionality. This requires user interaction and affects applications using the experimental remote function feature.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2026-82257 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82257 being exploited in the wild.

**How severe is CVE-2026-82257?** Medium severity, with a CVSS score of 4.3, published 28 August 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) SEMVER:introduced=0,fixed=2.69.1; SvelteKit <=2.69.0.

**Is there a fix for CVE-2026-82257?** Yes. @sveltejs/kit (npm): upgrade to 2.69.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82257 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82257?** Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 2.69.1 or later

  ```sh
  npm install @sveltejs/kit@2.69.1
  ```


## Technical details

This vulnerability is a prototype pollution flaw (CWE-1321) in SvelteKit's remote form function handler. When processing file input deletion in forms, the code fails to safely handle user-controlled file input names that contain prototype-polluting paths like "__proto__" or "constructor.prototype". An attacker can craft a form submission with a specially-named file input to inject properties into Object.prototype, potentially removing methods from built-in objects. The attack requires network access and user interaction (form submission), and affects SvelteKit versions <= 2.69.0. The issue is patched in versions 2.69.1 and 3.0.0-next.7 by using safe property deletion mechanisms already employed elsewhere in the codebase.

## Affected products

- Svelte SvelteKit <=2.69.0

## Identifiers

- CVE-2026-82257
- GHSA-866w-xmhq-wj7x

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: Patched in version 2.69.1 and 3.0.0-next.7

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x](https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x)
- [https://github.com/sveltejs/kit/pull/16218](https://github.com/sveltejs/kit/pull/16218)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)