2.3
Faible
CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…
Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| kit 3.0 | premières → < 3.0.0 | 3.0.0 |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de kit
Les 22 CVE de kit →
CVE-2026-114063
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on…
8.7
Élevée
CVE-2026-114062
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…
6.9
Moyenne
CVE-2026-114060
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on…
2.1
Faible
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0…
8.7
Élevée