---
id: "GHSA-5wg4-q3ww-283h"
page: "https://infrastack.ai/live/GHSA-5wg4-q3ww-283h"
kind: "vulnerability"
aliases: ["GHSA-5wg4-q3ww-283h"]
title: "Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@sveltejs/adapter-cloudflare", "fixed": ["7.2.10", "8.0.2"], "affected": ">= 4.7.0, <= 7.2.9, 8.0.0, 8.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cloudflare", "cwe-116", "cwe-79", "cwe-93", "npm", "package", "sveltekit"]
not_affected_if: ["controlled-links", "no-prerendering", "static-export"]
published_at: "2026-10-29T23:47:11+00:00"
first_seen_at: "2026-11-09T22:53:15+00:00"
updated_at: "2026-11-09T22:56:17+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h", "first_seen_at": "2026-11-09T22:53:15+00:00"}]
exploit_sources: []
---

# Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

Link for people: https://infrastack.ai/live/GHSA-5wg4-q3ww-283h (this .md is for agents)

The Cloudflare adapter for SvelteKit writes a _redirects file during build, and prerendered redirect paths are not sanitized before being added to it. An attacker who can influence the links crawled during prerendering can inject arbitrary redirect rules into the generated file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@sveltejs/adapter-cloudflare affected >= 4.7.0, <= 7.2.9, 8.0.0, 8.0.1 fixed 7.2.10, 8.0.2

## How to check

- Check the installed version with `npm ls @sveltejs/adapter-cloudflare`
- Look for a `_redirects` file in the build output of the Cloudflare deployment and review it for unexpected rules
- Confirm whether prerendering crawls links from content you do not control

## Fix

- `@sveltejs/adapter-cloudflare` `7.2.10` for the 7.x line
- `@sveltejs/adapter-cloudflare` `8.0.2` for the 8.x line

## Timeline

- 2026-11-09T22:53:15+00:00 ghsa-repo https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h

## From the sources

If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_