SvelteKit : XSS via untrusted cache-control header in prerendered page

Impact Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting XSS. SvelteKit inserts the header value into a tag without escaping it. An attacker who can influence this value at prerender time can break ou...