Cross-Site Scripting Vulnerability in SvelteKit by Svelte
CVE-2026-114061

2.3LOW

Key Information:

Vendor

Sveltejs

Status
Kit
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114061?

SvelteKit, specifically in versions prior to 3.0.0, is vulnerable to a cross-site scripting issue. This vulnerability arises from the failure to properly escape the cache-control header value set through setHeaders when it's included in a tag in prerendered pages. An attacker capable of manipulating this untrusted header value during prerendering can exploit it to break out of the content attribute, leading to the injection of arbitrary HTML or JavaScript. This can result in malicious scripts being executed in the browser of users visiting such pages, potentially compromising user data and the integrity of web applications.

Affected Version(s)

kit 0 < 3.0.0

kit 3.0.0

References

https://github.com/sveltejs/kit/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/sveltekit-before-3.0...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.