TI-2024-35724 Aliases CVE-2024-53261 GHSA-rjjv-87mx-6x3h

Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit

LOW 11CWE-79Published 2024-11-25 · Updated 2024-11-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0035 28th percentileScored 2026-11-07

Fix Fixed kit (sveltejs): 2.8.3@sveltejs/kit (npm): 2.8.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sveltejs	kit	before 2.8.3	2.8.3	Patch available	CNA
—	@sveltejs/kit (npm)	before 2.8.3	2.8.3	Patch available	GHSA-rjjv-87mx-6x3h

kit Vendorsveltejs Affected before 2.8.3 Fixed in 2.8.3 Patch available CNA
@sveltejs/kit (npm) Vendor— Affected before 2.8.3 Fixed in 2.8.3 Patch available GHSA-rjjv-87mx-6x3h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:svelte:sveltekit::::::node.js::*	before 2.8.3	Vulnerable	sveltejs

cpe:2.3:a:svelte:sveltekit:*:*:*:*:*:node.js:*:* Versions before 2.8.3 Vulnerable ·sveltejs

Remediation

Fix · CNA kit (sveltejs) Fixed in 2.8.3
Fix · GHSA-rjjv-87mx-6x3h @sveltejs/kit (npm) Fixed in 2.8.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-53261
2026-10-03 Alias added: GHSA-rjjv-87mx-6x3h

References

Patch 1

https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438

Advisory 2

Other 3

TI-2023-13469 SvelteKit framework has Insufficient CSRF protection for CORS requests CVSS 3.1HIGH 8.8
TI-2023-13464 SvelteKit has Insufficient Cross-Site Request Forgery Protection CVSS 3.1HIGH 8.8
TI-2026-56726 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization CVSS 4.0HIGH 8.7
TI-2026-56725 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization CVSS 4.0HIGH 8.7
TI-2026-56724 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form CVSS 4.0HIGH 8.7
TI-2026-56721 SvelteKit before 2.69.1 Denial of Service via Remote Form CVSS 4.0MEDIUM 6.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences