{"action":"Upgrade @sveltejs/kit to 2.69.1 or later.","affected":[{"fixed":"2.69.1","introduced":"0"}],"component":"@sveltejs/kit","cve_ids":["CVE-2026-82257"],"ecosystem":"npm","epss":0.00358,"exploited":false,"fixed_versions":["2.69.1"],"ghsa_id":"GHSA-866w-xmhq-wj7x","id":"tcs_01M5KFBY0HGRSKNJHFQCR2XWX6","modified_at":"2026-08-29T03:55:36.205388747Z","published_at":"2026-07-24T15:58:05Z","references":["https://osv.dev/vulnerability/GHSA-866w-xmhq-wj7x","https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x","https://github.com/sveltejs/kit/pull/16218","https://github.com/sveltejs/kit/commit/df32f6fe86cdd0b68b650e3e4631e5896453dcd3","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.69.1","https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0-next.7"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-866w-xmhq-wj7x","url":"https://osv.dev/vulnerability/GHSA-866w-xmhq-wj7x"}],"summary":"SvelteKit: Prototype pollution in file input deletion path in remote-function forms"}