CVE-2026-114061
CVE-2026-114061 · SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
kit
- Versions
- ≥ 0, < 3.0.0: Affected (semver)
- 3.0.0: Not affected (semver)
Update to 3.0.0
@sveltejs/kit npm
- Affected ranges
- SEMVER: < 3.0.0
Update to 3.0.0