Packages / @sveltejs/kit / Security

ModerateVulnerabilityGHSA-866w-xmhq-wj7xCVE-2026-82257Published 24 Jul 2026

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

Affected releases · @sveltejs/kit

  • 2.x2.0.0 – 2.69.0Fixed in 2.69.1
  • 1.x and older0.0.8 – 1.30.4No fix, no longer updated

On 2.x, the newest line:

npm install @sveltejs/kit@2.69.1
3.x

  1. Not affected

    3.0.0 – 3.1.0

    3 releases, latest

2.x

  1. Affected

    2.0.0 – 2.69.0

    230 releases

  2. Fixed

    2.69.1 – 2.70.3

    7 releases

1.x

  1. Affected

    1.0.0 – 1.30.4

    128 releases

0.x

  1. Affected

    0.0.8 – 0.0.30

    21 releases

389 stable releases of @sveltejs/kit, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @sveltejs/kit. It is read in your browser and sent nowhere.

What happens

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.