medium · CVSS v3 4.7

CVE-2026-114060

SvelteKit (SvelteJS/Kit) versions prior to 3.0.0 allow an open redirect via enhanced form actions when action paths begin with a double slas

Overview

SvelteKit (SvelteJS/Kit) versions prior to 3.0.0 allow an open redirect via enhanced form actions when action paths begin with a double slash. This flaw turns the path into a protocol‑relative URL, redirecting users to attacker‑controlled sites. It can be exploited by attackers to facilitate phishing or credential harvesting.

Description

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

Impact

The vulnerability enables attackers to redirect legitimate users to malicious domains, compromising confidentiality by facilitating credential theft and potentially undermining integrity by delivering deceptive content. End users of web applications built with SvelteKit are directly impacted, while developers and site operators face reputational and security risks.

Remediation

Upgrade to SvelteKit 3.0.0 or later where the double‑slash handling is fixed. If upgrading is not immediately possible, validate and sanitize all form action URLs on the server side, rejecting or normalizing paths that start with ‘//’. Additionally, configure a strict Content Security Policy to restrict navigation to trusted origins.

Risk context

The CVSS v3 score of 4.7 indicates a medium severity risk. With no EPSS data available, defenders should treat this as a moderate‑priority issue, applying patches promptly to mitigate potential phishing attacks.

Affected products

  • SvelteKit
  • SvelteJS/Kit

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.7
CVSS v4
—
EPSS
—

open-redirect SvelteKit web-application form-action double-slash medium mitigation

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis

medium

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

View analysis