Open Redirect Vulnerability in SvelteKit from SvelteJS

CVE-2026-114060

What is CVE-2026-114060?

SvelteKit, developed by SvelteJS, is susceptible to an open redirect issue present in enhanced form actions (use:enhance) on routes that handle paths starting with a double slash. This vulnerability allows attackers to create action paths that result in protocol-relative URLs, redirecting unsuspecting users to malicious sites. As a result, users may inadvertently navigate away from the intended application, exposing them to potential phishing or other exploitation methods. It is advisable for developers and users to upgrade their SvelteKit installations to version 3.0.0 or later to mitigate this risk.

References