{"id":"GHSA-5wg4-q3ww-283h","kind":"vulnerability","aliases":["GHSA-5wg4-q3ww-283h"],"related":[],"title":"Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`","description":"If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.","summary":"The Cloudflare adapter for SvelteKit writes a _redirects file during build, and prerendered redirect paths are not sanitized before being added to it. An attacker who can influence the links crawled during prerendering can inject arbitrary redirect rules into the generated file.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/adapter-cloudflare","fixed":["7.2.10","8.0.2"],"affected":">= 4.7.0, <= 7.2.9, 8.0.0, 8.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cloudflare","cwe-116","cwe-79","cwe-93","npm","package","sveltekit"],"not_affected_if":["controlled-links","no-prerendering","static-export"],"how_to_check":"- Check the installed version with `npm ls @sveltejs/adapter-cloudflare`\n- Look for a `_redirects` file in the build output of the Cloudflare deployment and review it for unexpected rules\n- Confirm whether prerendering crawls links from content you do not control","fix":"- `@sveltejs/adapter-cloudflare` `7.2.10` for the 7.x line\n- `@sveltejs/adapter-cloudflare` `8.0.2` for the 8.x line","status":"open","published_at":"2026-10-29T23:47:11+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:56:17+00:00","updated_at":"2026-11-09T22:56:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T22:56:17Z","model":"claude-haiku-5-5","output":{"fix":"- `@sveltejs/adapter-cloudflare` `7.2.10` for the 7.x line\n- `@sveltejs/adapter-cloudflare` `8.0.2` for the 8.x line","reach":"unknown","title":"SvelteKit Cloudflare adapter: crawled links can inject rules into _redirects","impact":"medium","summary":"The Cloudflare adapter for SvelteKit writes a _redirects file during build, and prerendered redirect paths are not sanitized before being added to it. An attacker who can influence the links crawled during prerendering can inject arbitrary redirect rules into the generated file.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","cloudflare","npm"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker alters Cloudflare redirect rules for the deployed site","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @sveltejs/adapter-cloudflare`\n- Look for a `_redirects` file in the build output of the Cloudflare deployment and review it for unexpected rules\n- Confirm whether prerendering crawls links from content you do not control","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-prerendering","static-export","controlled-links"],"who_is_affected":"Projects using @sveltejs/adapter-cloudflare that prerender pages and crawl links from sources an attacker can influence, such as user-generated content. Projects that do not prerender, or whose crawled links are fully controlled by the team, are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4655,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116':28B '-79':30B '-93':32B '283h':19A,24A '5wg4':17A,22A 'adapt':38B,105C 'add':56B,96C 'arbitrari':6A,71B 'attack':60B,80C 'build':46B,109C 'cloudflar':26B,37B,99C 'crawl':66B,85C 'cwe':27B,29B,31B 'entri':93C 'file':11A,44B,77B 'generat':12A,76B,102C 'ghsa':16A,21A 'ghsa-5wg4-q3ww-283h':15A,20A 'influenc':63B,82C,90C 'inject':5A,70B 'link':65B,84C 'npm':33B 'packag':34B 'path':3A,50B 'phase':106C 'platform':100C 'prerend':1A,48B,68B,87C 'q3ww':18A,23A 'redirect':2A,10A,43B,49B,72B,92C,101C 'rule':7A,73B 'sanit':53B 'sveltejs/adapter-cloudflare':14A,25A 'sveltekit':35B,40B 'write':41B","nicknames":[],"mitigations":[],"who_affected":"Projects using @sveltejs/adapter-cloudflare that prerender pages and crawl links from sources an attacker can influence, such as user-generated content. Projects that do not prerender, or whose crawled links are fully controlled by the team, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["adaptercloudflare"],"ptokens":["adapter","cloudflare","sveltejs"],"labels":["cloudflare","cwe116","cwe79","cwe93","medium","npm","package","sveltekit"],"campaign_type":null,"search_a":"'283h':19A,24A '5wg4':17A,22A 'arbitrari':6A 'file':11A 'generat':12A 'ghsa':16A,21A 'ghsa-5wg4-q3ww-283h':15A,20A 'inject':5A 'path':3A 'prerend':1A 'q3ww':18A,23A 'redirect':2A,10A 'rule':7A 'sveltejs/adapter-cloudflare':14A,25A","search_b":"'-116':28B '-79':30B '-93':32B 'adapt':38B 'add':56B 'arbitrari':71B 'attack':60B 'build':46B 'cloudflar':26B,37B 'crawl':66B 'cwe':27B,29B,31B 'file':44B,77B 'generat':76B 'influenc':63B 'inject':70B 'link':65B 'npm':33B 'packag':34B 'path':50B 'prerend':48B,68B 'redirect':43B,49B,72B 'rule':73B 'sanit':53B 'sveltekit':35B,40B 'write':41B","search_c":"'adapt':105C 'add':96C 'attack':80C 'build':109C 'cloudflar':99C 'crawl':85C 'entri':93C 'generat':102C 'influenc':82C,90C 'link':84C 'phase':106C 'platform':100C 'prerend':87C 'redirect':92C,101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-5wg4-q3ww-283h","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h","severity":"medium","published_at":"2026-10-29T23:47:11+00:00","modified_at":"2026-11-05T10:07:38+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":110416,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}