Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-114060

SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sveltejs kit

Default version status: unaffected

  • 0 to < 3.0.0affected
  • 3.0.0unaffected
pkg:npm/%40sveltejs/kit

References