{"id":"GHSA-m9j8-jcmv-hp69","kind":"vulnerability","aliases":["GHSA-m9j8-jcmv-hp69"],"related":[],"title":"Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle","description":"Under certain circumstances, server-only imports, which typically cannot be included in the client bundle, could make their way into it, potentially exposing secrets. This could only occur when those server-only imports were made through `src/params.js`.","summary":"Under certain conditions, modules meant only for the server can end up in the browser build of a SvelteKit app. Server secrets referenced through those imports can then be read by anyone who loads the client bundle.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":["3.1.1"],"affected":">= 3.0.0, <= 3.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-200","cwe-668","npm","package","svelte","sveltekit"],"not_affected_if":["no-params-js-server-imports","version-outside-range"],"how_to_check":"- Run `npm ls @sveltejs/kit` and confirm whether the installed version is between `3.0.0` and `3.1.0`.\n- Check whether `src/params.js` imports any server-only module that contains secrets.","fix":"- Upgrade `@sveltejs/kit` to `3.1.1`.","status":"open","published_at":"2026-10-29T23:47:22+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:54:27+00:00","updated_at":"2026-11-09T22:54:27+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@sveltejs/kit` to `3.1.1`.","reach":"internet","title":"SvelteKit: server-only imports can leak secrets into client bundle","impact":"high","summary":"Under certain conditions, modules meant only for the server can end up in the browser build of a SvelteKit app. Server secrets referenced through those imports can then be read by anyone who loads the client bundle.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","svelte","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"server secrets readable from the shipped client JavaScript bundle","analyst_note":"","how_to_check":"- Run `npm ls @sveltejs/kit` and confirm whether the installed version is between `3.0.0` and `3.1.0`.\n- Check whether `src/params.js` imports any server-only module that contains secrets.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-params-js-server-imports"],"who_is_affected":"Only apps that use `src/params.js` to import server-only modules are exposed. Apps that do not import server-only code through that file, or that run an unaffected version, can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4619,"output_tokens":485,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-200':34B '-668':36B 'anyon':72B 'app':60B 'browser':55B 'build':2A,56B 'build-tim':1A 'bundl':21A,77B,93C 'cannot':87C 'certain':42B,79C 'circumst':80C 'client':20A,76B,92C 'condit':43B 'could':10A,94C,104C 'cwe':33B,35B 'end':51B 'expos':101C 'fail':11A 'ghsa':23A,28A 'ghsa-m9j8-jcmv-hp69':22A,27A 'guard':9A 'hp69':26A,31A 'import':8A,66B,84C,112C 'includ':89C 'jcmv':25A,30A 'load':74B 'm9j8':24A,29A 'made':114C 'make':95C 'meant':45B 'modul':7A,44B 'npm':37B 'occur':106C 'packag':38B 'potenti':100C 'read':70B 'referenc':63B 'replac':18A 'result':12A 'secret':15A,62B,102C 'server':5A,14A,49B,61B,82C,110C 'server-on':4A,81C,109C 'src/params.js':116C 'static':17A 'svelt':39B 'sveltejs/kit':32A 'sveltekit':40B,59B 'time':3A 'typic':86C 'way':97C","nicknames":[],"mitigations":[],"who_affected":"Only apps that use `src/params.js` to import server-only modules are exposed. Apps that do not import server-only code through that file, or that run an unaffected version, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["kit"],"ptokens":["kit","sveltejs"],"labels":["cwe200","cwe668","high","npm","package","svelte","sveltekit"],"campaign_type":null,"search_a":"'build':2A 'build-tim':1A 'bundl':21A 'client':20A 'could':10A 'fail':11A 'ghsa':23A,28A 'ghsa-m9j8-jcmv-hp69':22A,27A 'guard':9A 'hp69':26A,31A 'import':8A 'jcmv':25A,30A 'm9j8':24A,29A 'modul':7A 'replac':18A 'result':12A 'secret':15A 'server':5A,14A 'server-on':4A 'static':17A 'sveltejs/kit':32A 'time':3A","search_b":"'-200':34B '-668':36B 'anyon':72B 'app':60B 'browser':55B 'build':56B 'bundl':77B 'certain':42B 'client':76B 'condit':43B 'cwe':33B,35B 'end':51B 'import':66B 'load':74B 'meant':45B 'modul':44B 'npm':37B 'packag':38B 'read':70B 'referenc':63B 'secret':62B 'server':49B,61B 'svelt':39B 'sveltekit':40B,59B","search_c":"'bundl':93C 'cannot':87C 'certain':79C 'circumst':80C 'client':92C 'could':94C,104C 'expos':101C 'import':84C,112C 'includ':89C 'made':114C 'make':95C 'occur':106C 'potenti':100C 'secret':102C 'server':82C,110C 'server-on':81C,109C 'src/params.js':116C 'typic':86C 'way':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-m9j8-jcmv-hp69","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-m9j8-jcmv-hp69","severity":"high","published_at":"2026-10-29T23:47:22+00:00","modified_at":"2026-10-29T23:47:23+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":110421,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-m9j8-jcmv-hp69","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}