CVE-2026-114061

low

Description

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.

References

https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages

https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107012

Details

Source: Mitre, NVD

Published: 2026-10-21

Updated: 2026-10-22

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

Severity: Medium

0

CVSS v4

Base Score: 2.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Severity: Low

EPSS

EPSS: 0.00213