Live › vulnerability › GHSA-85pr-xr59-r75h
Go to dashboardThis advisory is a withdrawn duplicate of GHSA-27mw-82g8-phjj, which covers the same SvelteKit issue. The original text says a Cache-Control header value set via setHeaders is inserted unescaped into a meta tag in prerendered pages, letting an attacker who controls that value run JavaScript in visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:45 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @sveltejs/kit | npm | < 3.0.0 | – |
Run npm ls @sveltejs/kit to see the installed version and check whether you use prerendering with setHeaders.
Upgrade @sveltejs/kit to 3.0.0 or later, per the original advisory GHSA-27mw-82g8-phjj.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references.
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
This page as .md · .json · in your agent: get_signal("GHSA-85pr-xr59-r75h")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.