{"id":"GHSA-85pr-xr59-r75h","kind":"vulnerability","aliases":["GHSA-85pr-xr59-r75h"],"related":[],"title":"Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references.\n\n## Original Description\nSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv=\"cache-control\"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","summary":"This advisory is a withdrawn duplicate of GHSA-27mw-82g8-phjj, which covers the same SvelteKit issue. The original text says a Cache-Control header value set via setHeaders is inserted unescaped into a meta tag in prerendered pages, letting an attacker who controls that value run JavaScript in visitors' browsers.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":[],"affected":"< 3.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","npm","package","prerendered-pages","sveltekit"],"not_affected_if":["kit-3.0.0-or-later","no-prerendering","no-untrusted-cache-header-input"],"how_to_check":"Run npm ls @sveltejs/kit to see the installed version and check whether you use prerendering with setHeaders.","fix":"Upgrade @sveltejs/kit to 3.0.0 or later, per the original advisory GHSA-27mw-82g8-phjj.","status":"withdrawn","published_at":"2026-10-21T03:32:18+00:00","first_seen_at":"2026-10-23T20:45:22+00:00","triaged_at":"2026-10-23T20:46:23+00:00","updated_at":"2026-10-23T20:46:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:46:23Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @sveltejs/kit to 3.0.0 or later, per the original advisory GHSA-27mw-82g8-phjj.\nunknown","reach":"internet","summary":"This advisory is a withdrawn duplicate of GHSA-27mw-82g8-phjj, which covers the same SvelteKit issue. The original text says a Cache-Control header value set via setHeaders is inserted unescaped into a meta tag in prerendered pages, letting an attacker who controls that value run JavaScript in visitors' browsers.","category":"package","who_cares":["sveltekit","npm","prerendered-pages"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker runs JavaScript in visitors' browsers on affected prerendered pages","analyst_note":"Withdrawn duplicate; verify the fix and details on GHSA-27mw-82g8-phjj, the canonical advisory, and whether the version bound 3.0.0 is correct.","how_to_check":"Run npm ls @sveltejs/kit to see the installed version and check whether you use prerendering with setHeaders.\nunknown","needs_analyst":true,"not_affected_if":["no-prerendering","no-untrusted-cache-header-input","kit-3.0.0-or-later"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000506,"input_tokens":2649,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-79':27B '27mw':43B,102C '3.0.0':5A,118C '82g8':44B,103C '85pr':17A,22A 'advisori':2A,35B,88C,90C 'attack':77B,147C 'attribut':163C 'break':158C 'browser':86B 'cach':9A,58B,132C 'cache-control':8A,57B,131C 'contain':119C 'content':162C 'control':10A,59B,79B,133C 'cover':47B 'cross':122C 'cross-sit':121C 'cwe':26B 'descript':114C 'duplic':1A,39B,87C,98C 'escap':142C 'execut':170C 'extern':111C 'ghsa':16A,21A,42B,101C 'ghsa-27mw-82g8-phjj':41B,100C 'ghsa-85pr-xr59-r75h':15A,20A 'header':11A,60B,134C 'html':166C 'influenc':150C 'inject':165C 'insert':66B,140C 'issu':51B 'javascript':83B,168C 'let':75B 'link':106C 'maintain':108C 'meta':70B 'npm':28B 'origin':53B,113C 'packag':29B 'page':14A,32B,74B,128C,175C 'phjj':45B,104C 'prerend':13A,31B,73B,127C,155C 'prerendered-pag':30B 'preserv':110C 'r75h':19A,24A 'refer':112C 'run':82B 'say':55B 'script':124C 'set':62B,136C 'sethead':64B,138C 'site':123C 'sveltejs/kit':25A,116C 'sveltekit':3A,33B,50B,115C 'tag':71B,145C 'text':54B 'time':156C 'unescap':67B 'untrust':152C 'user':172C 'valu':61B,81B,135C,153C 'via':7A,63B,137C 'visit':173C 'visitor':85B 'vulner':125C 'withdrawn':38B,93C 'without':141C 'xr59':18A,23A 'xss':6A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T03:32:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-85pr-xr59-r75h","url":"https://github.com/advisories/GHSA-85pr-xr59-r75h","severity":"low","published_at":"2026-10-21T03:32:18+00:00","modified_at":"2026-10-23T20:43:08+00:00","first_seen_at":"2026-10-23T20:45:22+00:00","fetched_at":"2026-10-23T20:45:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}