SvelteKit versions prior to 2.69.1 contain a prototype pollution flaw that is triggered by remote form functions handling file input fields. The flaw allows an attacker to provide a crafted path name that alters the deletion path used by the framework, causing methods on JavaScript prototypes to be removed. This can disable application functionality, resulting in a denial‑of‑service condition for users of the affected system.

The vulnerability affects the sveltejs:kit product, specifically any version earlier than 2.69.1.

The CVSS score is 5.3, indicating a medium severity impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation is not currently documented. The likely attack vector is the submission of a malicious file path via a standard form submission to the web application, requiring no special privileges. While the flaw does not lead to remote code execution, an attacker could use it to disrupt service by removing prototype methods critical to the application’s operation.