Prototype Pollution in Ciscoheat Sveltekit-Superforms

CVE-2025-62381

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. This vulnerability is fixed in 2.27.4.

Vulnerability class: Prototype Pollution

Published · last modified .

EPSS exploit prediction

EPSS: 0.006 (44.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-62381: held from 0.005 to 0.006.

EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-62381?
CVE-2025-62381 is a vulnerability in Ciscoheat Sveltekit-Superforms, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). Published 2025-10-15.
Is CVE-2025-62381 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.