PT-2026-120187 · Sveltejs · Kit
CVE-2026-114061
·
Published
2026-10-21
·
Updated
2026-10-21
CVSS v3.1
4.7
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kit