Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sveltejs/kit | npm | <= 2.69.0 | 2.69.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic case of prototype pollution in JavaScript. It occurs within the form function in packages/kit/src/runtime/client/remote-functions/form.svelte.js. The root cause was the insecure handling of file input deletion in remote forms. When a file was cleared from a form, the application would attempt to remove the corresponding data from the internal state. The code responsible for this deletion manually parsed the name attribute of the input field to determine the path to the property that needed to be deleted. This manual implementation did not sanitize the path segments, allowing an attacker to inject __proto__ into the path. This would cause the delete operation to act on the Object.prototype instead of the intended form data object, allowing the attacker to remove built-in methods and properties, which could lead to denial of service or other unexpected behavior. The patch rectifies this by replacing the vulnerable manual deletion logic with a call to the existing set_nested_value function, which leverages the deep_set utility. The deep_set function already contains checks to prevent prototype pollution, thus closing the security hole.
formpackages/kit/src/runtime/client/remote-functions/form.svelte.js