Remote Code Execution Vulnerability in SvelteKit by Svelte
CVE-2026-128121
5.9MEDIUM
What is CVE-2026-128121?
SvelteKit, a framework for building performant web applications, contains a vulnerability that allows an attacker to manipulate links during prerendering. If these links are emitted into the Vercel routing configuration without proper escaping of regular-expression metacharacters, attackers may cause unintended paths to be matched, leading to potential exposure of sensitive content or unexpected behavior in the application. This issue has been addressed in updates of @sveltejs/adapter-vercel and @sveltejs/adapter-static. To mitigate risks, users should upgrade to the specified secure versions.
Affected Version(s)
adapter-static < 3.0.11 < 3.0.11
adapter-static >= 4.0.0-next.0, < 4.0.1 < 4.0.0-next.0, 4.0.1
adapter-vercel < 6.3.5 < 6.3.5