Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: sveltejs kit 3.0.0 Clear all filters
TI-2026-78676 CVE-2026-114063

Path traversal in SvelteKit vite preview on Windows exposes files

Priority MEDIUM 44

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output director…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00405 Published 2026-10-21 Fixed in 3.0.0 CWE-22
TI-2026-78675 CVE-2026-114062

Server-side request forgery in SvelteKit self-fetch fallbacks

Priority LOW 36

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00352 Published 2026-10-21 Fixed in 3.0.0 CWE-918
TI-2026-78674 CVE-2026-114061 · GHSA-27mw-82g8-phjj

Cross-site scripting in SvelteKit prerendered pages via cache-control header

Priority LOW 11

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cach…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00213 Published 2026-10-21 Fixed in 3.0.0 CWE-79
TI-2026-78673 CVE-2026-114060 · GHSA-pfhg-q3qv-9q6r

Open redirect in SvelteKit enhanced form actions

Priority LOW 11

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00202 Published 2026-10-21 Fixed in 3.0.0 CWE-601