Vulnerability in SvelteKit Framework Exposes Server Secrets
CVE-2026-128118

7.5HIGH

Key Information:

Vendor

Sveltejs

Status
Kit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128118?

The SvelteKit framework contains a vulnerability where server-only modules, accessible through src/params.js, can leak private environment values and other sensitive server secrets into the client bundle. This misconfiguration, which affects versions 3.0.0 to 3.1.1, permits unauthorized access to server-side information that should remain confidential. The issue has been addressed in version 3.1.1, ensuring that the build-time server-only module guard operates correctly, preventing the exposure of sensitive data in client applications.

Affected Version(s)

kit >= 3.0.0, < 3.1.1

References

https://github.com/sveltejs/kit/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/sveltejs/kit/commit/ae07803806f75b8b56...
x_refsource_MISC
https://github.com/sveltejs/kit/releases/tag/@sveltejs/ki...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.