CVE-2026-128122

The @sveltejs/adapter-cloudflare component within the SvelteKit framework is vulnerable to an injection flaw in versions 4.7.0 through 7.2.10 and 8.0.2 . During the prerendering process, the adapter fails to perform output-context validation on links crawled from external sources. This allows an ...

CVE-2026-128122 SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or...

CVE-2026-128121 SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel...

CVE-2026-128121

The SvelteKit framework is vulnerable to a flaw where attacker-influenced links crawled during prerendering are emitted into the generated Vercel routing configuration without proper escaping of regular-expression metacharacters. This affects @sveltejs/adapter-vercel versions prior to 6.3.5 and 7...

CVE-2026-128120

The SvelteKit framework is vulnerable to a Denial of Service (DoS) attack when using the experimental remote functions flag with a remote form function. In versions 2.42.0 through 3.1.1 , parsing a specially crafted request containing many form entries can trigger quadratic synchronous work , blo...

CVE-2026-128119

The SvelteKit framework (versions 2.60.1 through 3.1.1 ) is vulnerable to a collision of identifiers for private query.batch functions when using the experimental remote functions flag. This root cause allows arguments intended for one function to be passed to another within a shared request batc...

CVE-2026-128118

The SvelteKit framework (versions 3.0.0 through 3.1.1) contains a build-time vulnerability where the server-only module guard fails to identify src/params.js as a client entry point. Because parameter matchers can execute in the browser, server-only modules imported via this file may be incorrect...

CVE-2026-128117

SvelteKit versions prior to 2.70.4 and 3.1.1 are vulnerable to a DoS issue where the reroute hook improperly handles malformed pathnames. Specifically, an invalid percent-encoded pathname could be rewritten into a valid route, leading the system to decode the malformed pathname outside of a guard...

CVE-2026-128116

The SvelteKit framework is vulnerable to cross-origin script execution in versions prior to 2.70.4 and 3.1.1 . When configured with router.resolution: 'server', the application may treat pathnames starting with // as protocol-relative module specifiers during client-side navigation. This allows a...

kestrel

The kernel-level visibility of Falco, with the live UI the kernel-native tools don't ship. Quickstart · Spec · Views · Roadmap Kestrel traces kernel events process exec, file access, network connections with an eBPF agent and streams them to a SvelteKit web app that renders a live activity feed,...

CloakBin

CloakBin Zero-Knowledge Encrypted Pastebin Your data is encrypted in your browser before it leaves your machine. The server only ever stores ciphertext. Live Demo • Report Bug • Request Feature Share a secret straight from your terminal. It encrypts on your machine before anything uploads: echo...

CVE-2026-114062

A flaw was found in SvelteKit. This Server-Side Request Forgery SSRF vulnerability allows a remote attacker to access internal network services that should not be publicly accessible. By manipulating the HTTP Host or forwarded headers, an attacker can direct internal self-fetch fallback requests ...

SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

GHSA-PFHG-Q3QV-9Q6R SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

EUVD-2026-107012

SvelteKit : XSS via untrusted cache-control header in prerendered page...

SvelteKit : XSS via untrusted cache-control header in prerendered page

Impact Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting XSS. SvelteKit inserts the header value into a tag without escaping it. An attacker who can influence this value at prerender time can break ou...

Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on...

Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...

GHSA-85PR-XR59-R75H Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...