{"id":"CVE-2026-114060","kind":"vulnerability","aliases":["CVE-2026-114060","GHSA-pfhg-q3qv-9q6r"],"related":[],"title":"SvelteKit: URL redirection to untrusted site via enhanced form submission","description":"### Impact\nApplications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.\n\n### Patches\nA fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.\n\nThe fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.\n\n### Workarounds\nReject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.\n\nAlternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:\n\n```svelte\n<form method=\"POST\" use:enhance={() => ({ update }) => update({ navigate: false })}>\n  <!-- form fields -->\n</form>\n```\n\nThis applies non-redirect results to the current page instead of navigating to the action location.","summary":"SvelteKit apps using enhanced form actions (use:enhance) on routes that accept paths starting with // can redirect users after form submission. An attacker can use this to send victims to an arbitrary external site, which enables phishing.","severity":"medium","cvss":4.7,"epss":0.00165,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":["3.0.0"],"affected":"< 3.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-601","npm","runtime","svelte","sveltekit"],"not_affected_if":["no-catch-all-routes","no-use-enhance-forms","on-3.0.0-or-later"],"how_to_check":"Check the @sveltejs/kit version in package.json or the lockfile; below 3.0.0 is affected. Look for use:enhance forms on catch-all or other routes that accept paths beginning with //.","fix":"Upgrade @sveltejs/kit to 3.0.0 or later. Until then, reject requests whose pathname begins with // in a reverse proxy or a SvelteKit handle hook, or pass a custom use:enhance callback with update({ navigate: false }).","status":"open","published_at":"2026-10-21T01:17:29+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:31+00:00","updated_at":"2026-10-23T21:57:27+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:00:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @sveltejs/kit to 3.0.0 or later. Until then, reject requests whose pathname begins with // in a reverse proxy or a SvelteKit handle hook, or pass a custom use:enhance callback with update({ navigate: false }).","reach":"internet","impact":"medium","summary":"SvelteKit apps using enhanced form actions (use:enhance) on routes that accept paths starting with // can redirect users after form submission. An attacker can use this to send victims to an arbitrary external site, which enables phishing.","category":"runtime","who_cares":["sveltekit","svelte","npm"],"confidence":0.8,"needs_auth":"no","worst_case":"Users redirected to attacker-chosen external site after form submission","analyst_note":"","how_to_check":"Check the @sveltejs/kit version in package.json or the lockfile; below 3.0.0 is affected. Look for use:enhance forms on catch-all or other routes that accept paths beginning with //.","needs_analyst":false,"not_affected_if":["no-use-enhance-forms","no-catch-all-routes","on-3.0.0-or-later"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000978,"input_tokens":3102,"output_tokens":1335,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114060':13A,21A '-2026':12A,20A '-601':24B '3.0.0':102C,107C '9q6r':18A 'accept':40B,77C 'action':34B,71C,117C,129C,141C,211C 'altern':170C 'app':30B 'appli':197C 'applic':67C 'arbitrari':60B 'attack':51B 'begin':79C,154C 'callback':185C 'catch':84C 'catch-al':83C 'compar':140C 'current':133C,145C,204C 'custom':183C 'cve':11A,19A 'cwe':23B 'disabl':171C 'doubl':114C 'enabl':64B 'enhanc':8A,32B,36B,69C,73C,177C,191C 'exampl':160C 'extern':61B 'fals':195C 'fix':96C,111C 'form':9A,33B,48B,70C,178C,187C 'generat':120C 'ghsa':15A 'ghsa-pfhg-q3qv-9q6r':14A 'handl':168C 'hook':169C 'impact':66C 'includ':136C 'instead':206C 'later':109C 'lead':113C 'locat':142C,212C 'may':87C 'method':188C 'navig':130C,172C,194C,208C 'non':127C,175C,199C 'non-redirect':126C,174C,198C 'npm':25B 'open':92C 'origin':134C,138C 'page':146C,205C 'pars':151C 'patch':94C 'path':41B,78C,118C 'pathnam':153C 'pfhg':16A 'phish':65B 'post':189C 'prepar':99C 'preserv':112C 'protocol':122C 'protocol-rel':121C 'proxi':164C 'q3qv':17A 'redirect':3A,45B,93C,128C,176C,200C 'reject':148C 'relat':123C 'request':149C 'resolut':158C 'restrict':125C 'result':179C,201C 'revers':163C 'rout':38B,75C,86C,157C 'runtim':26B 'send':56B 'site':6A,62B 'slash':115C 'start':42B 'submiss':10A,49B,184C 'suppli':181C 'svelt':27B,186C 'sveltejs/kit':22A,101C 'sveltekit':1A,28B,29B,167C 'untrust':5A 'updat':192C,193C 'upgrad':105C 'url':2A,124C,152C 'use':31B,35B,53B,68C,72C,190C 'user':46B,103C 'via':7A 'victim':57B 'vulner':89C 'whose':150C 'without':119C 'workaround':147C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pfhg-q3qv-9q6r","url":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r","severity":"low","published_at":"2026-10-23T20:58:24+00:00","modified_at":"2026-10-23T20:58:25+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114060","severity":null,"published_at":"2026-10-21T01:17:29+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}