Is CVE-2026-82257 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82257?

CVE-2026-82257 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-82257

Description

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.