@sveltejs/kit@1.0.0-next.408

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via server-side self-fetch fallbacks that automatically follow HTTP redirects. SvelteKit makes server-side fallback requests to URLs derived from the incoming request origin in several scenarios: retrieving prerendered data for experimental prerender remote functions, serving rerouted prerendered content, fetching static or prerendered resources without an internal read implementation, and handling same-origin subrequests unresolvable from the server manifest. An attacker who can influence the request origin - for example by manipulating Host or forwarded host/protocol headers - can cause these fallback requests to reach an attacker-controlled server, which then redirects them to internal services.

Note: Exposure depends on the adapter and deployment configuration; for example, this is exploitable with adapter-node when the request origin is derived from unvalidated Host or forwarded host/protocol headers.

Upgrade @sveltejs/kit to version 3.0.0 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) through the Accept header processing. An attacker can exhaust CPU resources by sending specially crafted Accept headers, potentially leading to service unavailability. This is only exploitable if header length limits are raised or absent.

Upgrade @sveltejs/kit to version 2.70.2 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Prototype Pollution in the file input deletion path in remote-function forms when arbitrary user-controlled path names are accepted for input fields of type file. An attacker can remove methods on the prototype by submitting specially crafted input values.

Upgrade @sveltejs/kit to version 2.69.1, 3.0.0-next.7 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Uncaught Exception via the form function when processing large remote payloads. An attacker can cause the Node process to crash by repeatedly submitting oversized payloads.

Upgrade @sveltejs/kit to version 2.69.1, 3.0.0-next.7 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the request processing. An attacker can send requests that exceed BODY_SIZE_LIMIT restriction to applications running with adapter-node and cause an application to crash.

Upgrade @sveltejs/kit to version 2.57.1 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the redirect() function in the handle server hook when the location parameter contains characters invalid in an HTTP header. An attacker can cause an unhandled TypeError and disrupt service availability by supplying unsanitized user input to the location parameter.

Upgrade @sveltejs/kit to version 2.57.1 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to the unsanitized input from the request URL that flows into end, where it is used to render an HTML page returned to the user. An attacker can execute scripts in the context of the user's browser by manipulating the input to the request URL.

Note:

This is only exploitable if the Vite development server is exposed to the network, which is not the default configuration.

Upgrade @sveltejs/kit to version 2.8.3 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the error.html template. An attacker can inject malicious content by exploiting unescaped placeholders in error messages that contain user-controlled input.

Note:

This is only exploitable if user-provided input is used in the Error message.

Upgrade @sveltejs/kit to version 2.8.3 or higher.

@sveltejs/kit is a SvelteKit framework and CLI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by allowing malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.

Upgrade @sveltejs/kit to version 1.15.2 or higher.