CVE-2026-82257

SvelteKit versions before 2.69.1 are affected by a prototype pollution vulnerability in remote form functions that accept file input fields with user-controlled path names. An attacker can manipulate the deletion path to remove methods on the object prototype, potentially disabling application fu...

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...