2.3
Low
CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kit 3.0 | earliest → < 3.0.0 | 3.0.0 |
Other CVEs of kit
The 22 CVEs of kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
High
CVE-2026-114062
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
6.9
Medium
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Low
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0…
8.7
High