CVE-2026-114060
CVE-2026-114060 · SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
CVSS 2.1 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
kit
- Versions
- ≥ 0, < 3.0.0: Affected (semver)
- 3.0.0: Not affected (semver)
Update to 3.0.0
@sveltejs/kit npm
- Affected ranges
- SEMVER: < 3.0.0
Update to 3.0.0