---
id: "CVE-2024-53262"
kind: "vulnerability"
aliases: ["CVE-2024-53262", "GHSA-mh2x-fcqh-fmqv"]
title: "@sveltejs/kit has unescaped error message included on error page"
severity: "medium"
cvss: 5.4
epss: 0.00482999999076128
exploited: false
status: "open"
category: "package"
products: [{"name": "@sveltejs/kit", "fixed": ["2.8.3"], "affected": "< 2.8.3", "ecosystem": "npm"}, {"name": "svelte sveltekit", "fixed": ["2.8.3"], "affected": "< 2.8.3", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-79", "next.js", "package", "svelte", "sveltekit"]
not_affected_if: ["default-config", "no-user-input-in-errors", "static-export"]
published_at: "2024-11-25T15:32:45+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mh2x-fcqh-fmqv", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53262", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# @sveltejs/kit has unescaped error message included on error page

The static error.html template in @sveltejs/kit replaces its error message placeholder without escaping it first. If an app passes user-controlled text into a thrown error message, that text is rendered as raw HTML on the error page, enabling cross-site scripting.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/kit affected < 2.8.3 fixed 2.8.3
- vendor:svelte sveltekit affected < 2.8.3 fixed 2.8.3

## How to check

Search server code for calls to error(...) whose message includes request data, e.g. grep -rn "error(" src/ and inspect the arguments.
Check package.json for @sveltejs/kit version below 2.8.3.

## Fix

Upgrade @sveltejs/kit to 2.8.3 or later.
Do not put unsanitized user input into error() messages until upgraded.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-mh2x-fcqh-fmqv
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-53262

## From the sources

### Summary

The static error.html template for errors contains placeholders that are replaced without escaping the content first.

### Details

From https://kit.svelte.dev/docs/errors:

> error.html is the page that is rendered when everything else fails. It can contain the following placeholders:
%sveltekit.status% — the HTTP status
%sveltekit.error.message% — the error message

This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content that ends up being something like this inside a server handle function: 
```js
error(500, '<script>alert("boom")</script>');
```
Uncaught errors cannot be exploited like this, as they always render the message "Internal error".

Escaping the message string in the function that creates the html output can be done to improve safety for applications that are using custom errors on the server.

### PoC

None provided

### Impact

Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_