Approved changes feed: RSS · Atom
cpe:2.3:a:svelte:kit:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Svelte (3cbea947-984c-58fb-b7e8-6d86eddc1f6a) |
|---|---|
| Product | Kit (bb74572d-404e-50d1-a5f7-6fd418e8d225) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/sveltejs/kit |
purl2cpe | 2026-06-01 10:17:46.179596 |
pkg:npm/%40sveltejs/kit |
purl2cpe | 2026-06-01 10:17:46.179599 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114062 |
vulnerable | 2026-11-03 10:15:53.832724 |
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
MEDIUM (5.3)
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Published: 2026-10-21T00:36:36.158Z
Updated: 2026-10-22T17:58:07.497Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114063 |
vulnerable | 2026-11-03 10:15:53.750388 |
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
HIGH (7.5)
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
Published: 2026-10-21T00:36:36.847Z
Updated: 2026-10-27T21:43:53.677Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114061 |
vulnerable | 2026-11-03 10:15:53.466838 |
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
MEDIUM (4.7)
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Published: 2026-10-21T00:36:35.456Z
Updated: 2026-10-28T15:19:51.281Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114060 |
vulnerable | 2026-11-03 10:15:52.924941 |
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
MEDIUM (4.7)
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
Published: 2026-10-21T00:36:34.741Z
Updated: 2026-10-21T15:50:38.726Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.