{"id":"CVE-2024-53262","kind":"vulnerability","aliases":["CVE-2024-53262","GHSA-mh2x-fcqh-fmqv"],"related":[],"title":"@sveltejs/kit has unescaped error message included on error page","description":"### Summary\n\nThe static error.html template for errors contains placeholders that are replaced without escaping the content first.\n\n### Details\n\nFrom https://kit.svelte.dev/docs/errors:\n\n> error.html is the page that is rendered when everything else fails. It can contain the following placeholders:\n%sveltekit.status% — the HTTP status\n%sveltekit.error.message% — the error message\n\nThis leads to possible injection if an app explicitly creates an error with a message that contains user controlled content that ends up being something like this inside a server handle function: \n```js\nerror(500, '<script>alert(\"boom\")</script>');\n```\nUncaught errors cannot be exploited like this, as they always render the message \"Internal error\".\n\nEscaping the message string in the function that creates the html output can be done to improve safety for applications that are using custom errors on the server.\n\n### PoC\n\nNone provided\n\n### Impact\n\nOnly applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable","summary":"The static error.html template in @sveltejs/kit replaces its error message placeholder without escaping it first. If an app passes user-controlled text into a thrown error message, that text is rendered as raw HTML on the error page, enabling cross-site scripting.","severity":"medium","cvss":5.4,"epss":0.00482999999076128,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":["2.8.3"],"affected":"< 2.8.3","ecosystem":"npm"},{"name":"svelte sveltekit","fixed":["2.8.3"],"affected":"< 2.8.3","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-79","next.js","package","svelte","sveltekit"],"not_affected_if":["default-config","no-user-input-in-errors","static-export"],"how_to_check":"Search server code for calls to error(...) whose message includes request data, e.g. grep -rn \"error(\" src/ and inspect the arguments.\nCheck package.json for @sveltejs/kit version below 2.8.3.","fix":"Upgrade @sveltejs/kit to 2.8.3 or later.\nDo not put unsanitized user input into error() messages until upgraded.","status":"open","published_at":"2024-11-25T15:32:45+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T21:49:12+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:49:12Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @sveltejs/kit to 2.8.3 or later.\nDo not put unsanitized user input into error() messages until upgraded.","reach":"internet","impact":"medium","summary":"The static error.html template in @sveltejs/kit replaces its error message placeholder without escaping it first. If an app passes user-controlled text into a thrown error message, that text is rendered as raw HTML on the error page, enabling cross-site scripting.","category":"package","who_cares":["sveltekit","svelte","next.js"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker script runs in victim's browser on the app's origin.","analyst_note":"","how_to_check":"Search server code for calls to error(...) whose message includes request data, e.g. grep -rn \"error(\" src/ and inspect the arguments.\nCheck package.json for @sveltejs/kit version below 2.8.3.\nunknown","needs_analyst":false,"not_affected_if":["default-config","static-export","no-user-input-in-errors"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000505,"input_tokens":3062,"output_tokens":398,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,19A '-53262':12A,20A '-79':25B '/docs/errors:':95C '500':155C 'alway':165C 'app':47B,128C 'applic':190C,204C,223C 'cannot':158C 'contain':81C,109C,137C 'content':89C,140C 'control':51B,139C 'creat':130C,179C 'cross':71B 'cross-sit':70B 'custom':194C 'cve':10A,18A 'cwe':24B 'detail':91C 'done':185C 'els':105C 'enabl':69B 'end':142C 'error':4A,8A,38B,56B,67B,80C,119C,132C,154C,157C,170C,195C,213C 'error.html':32B,77C,96C 'escap':42B,87C,171C 'everyth':104C 'explicit':129C 'exploit':160C 'fail':106C 'fcqh':16A 'first':44B,90C 'fmqv':17A 'follow':111C 'function':152C,177C 'ghsa':14A 'ghsa-mh2x-fcqh-fmqv':13A 'handl':151C 'html':64B,181C 'http':115C 'impact':202C 'improv':187C 'includ':6A 'inject':125C 'input':208C 'insid':148C 'intern':169C 'js':153C 'kit.svelte.dev':94C 'kit.svelte.dev/docs/errors:':93C 'lead':122C 'like':146C,161C 'major':221C 'messag':5A,39B,57B,120C,135C,168C,173C,214C 'mh2x':15A 'next.js':26B 'none':200C 'output':182C 'packag':27B 'page':9A,68B,99C 'pass':48B 'placehold':40B,82C,112C 'poc':199C 'possibl':124C 'provid':201C,207C 'raw':63B 'render':61B,102C,166C 'replac':36B,85C 'safeti':188C 'script':73B 'server':150C,198C 'site':72B 'someth':145C 'static':31B,76C 'status':116C 'string':174C 'summari':74C 'svelt':28B 'svelte':22A 'sveltejs/kit':1A,21A,35B 'sveltekit':23A,29B 'sveltekit.error.message':117C 'sveltekit.status':113C 'templat':33B,78C 'text':52B,59B 'thrown':55B 'uncaught':156C 'unescap':3A 'use':193C,210C 'user':50B,138C,206C 'user-control':49B 'vast':220C 'vulner':217C,227C 'without':41B,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-25T15:32:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mh2x-fcqh-fmqv","url":"https://github.com/advisories/GHSA-mh2x-fcqh-fmqv","severity":"low","published_at":"2024-11-25T15:32:45+00:00","modified_at":"2026-10-18T14:59:48+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-53262","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53262","severity":null,"published_at":"2024-11-25T20:15:10+00:00","modified_at":"2026-06-17T08:08:42+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}