@SVELTEJS/KIT · GHSA-6cf5-gc4q-fm3x · Package
FIX → 3.1.1
Under certain conditions, non-exported `query.batch` remote functions in SvelteKit can end up in the same batch, so one function receives arguments meant for another. The sources describe this as a permission and function-mixing flaw (CWE-863) rather than code execution.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only apps that enable the experimental remote functions flag and use non-exported query.batch functions can be affected. Apps without that flag, or that only use exported batch functions, are outside the described condition. The sources do not describe a data path from outside the app.
Not affected if experimental-flag-off, exported-batch-functions-only, versions-outside-range
Who cares npm, svelte, sveltekit
@sveltejs/kit with npm ls @sveltejs/kitquery.batch and check whether any of those functions are not exportedsvelte.config.jsUpgrade to 3.1.1
Under certain circumstances, private (non-exported) query.batch functions could end up sharing a batch, resulting in the arguments from one function being passed to another. This only affects apps using the experimental remote functions flag and non-exported query.batch functions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@sveltejs/kit fixed in 3.1.1; affected range >= 2.60.1, <= 3.1.0