ghsa:GHSA-PVHG-7V4P-F5Q9: @sveltejs/kit < 3.0.0

Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions. Affected range: < 3.0.0.

Affected technology

@sveltejs/kit · < 3.0.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites. Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as low; availability impact as none.

Published 24-Oct-2026 01:47 UTC

Product: @sveltejs/kit
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-pvhg-7v4p-f5q9.html