Web Application Framework Vulnerability in SvelteKit by Svelte
CVE-2026-128122
5.9MEDIUM
What is CVE-2026-128122?
A vulnerability in the SvelteKit framework, specifically in the @sveltejs/adapter-cloudflare component, allows attackers to manipulate link paths during prerendering. This could lead to the creation of unintended routing rules that may expose or redirect requests beyond their intended paths due to a lack of output-context validation. The issue affects versions from 4.7.0 to 7.2.9 and 8.0.0 to 8.0.1, and it is resolved in versions 7.2.10 and 8.0.2.
Affected Version(s)
kit >= 4.7.0, < 7.2.10 < 4.7.0, 7.2.10
kit >= 8.0.0-next.0, < 8.0.2 < 8.0.0-next.0, 8.0.2