Remote Functions Vulnerability in SvelteKit Framework

CVE-2026-128119

What is CVE-2026-128119?

The SvelteKit framework, used for developing web applications, contains a vulnerability related to its experimental remote functions. In versions 2.60.1 through 3.1.1, there is a potential for applications that use this feature to mistakenly share an identifier between private, non-exported query.batch functions. This flaw allows for unintended argument sharing between different functions when they handle the same request batch. As a result, sensitive data and function arguments intended for a specific function could be disclosed to another. This issue has been resolved in SvelteKit version 3.1.1, which addresses the identifier assignment correctly, ensuring that each function maintains its separation and security.

References