Live › vulnerability › CVE-2026-114063
Go to dashboardSvelteKit's vite preview server on Windows fails to block path traversal, so anyone who can reach it can read files outside the prerendered output directory. Readable source code, configuration, or credentials on the server can be exposed without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run npm ls @sveltejs/kit to find versions 2.10.0 through 2.x; check whether vite preview runs on a Windows host reachable from a network or tunnel.
Upgrade @sveltejs/kit to 3.0.0 or later; do not expose vite preview to networks, and rotate any secrets the preview process could read if it was reachable.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-114063")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.