P5Verified

CVE-2025-62381: sveltekit-superforms < 2.27.4

CVE-2025-62381. EPSS 0.00553 (percentile 0.44387), scored 2026-10-06.

Affected technology

sveltekit-superforms · < 2.27.4
ciscoheat

Component: Not specified by the source
Function: of

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code execution in downstream applications that rely on polluted objects. Vendor/CNA’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality and integrity impact as low; availability impact as high.

Published 2026-10-08 17:35:17.607813+00:00

CWE: CWE-1321
CCR priority: 0.1 /100 (P5)
EPSS: 0.00553 · percentile 0.44489 · 2026-10-08
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-08 17:36:22.845483+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-08 17:32:11.049884+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-62381.html