Live › vulnerability › GHSA-pvhg-7v4p-f5q9
Go to dashboardSvelteKit's enhanced form actions (use:enhance) can be made to navigate the browser to an attacker-controlled site when an action path begins with a double slash. An attacker who can influence that path can send a victim to a phishing or malicious page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @sveltejs/kit | npm | < 3.0.0 | – |
Check the installed version with: npm ls @sveltejs/kit
Any version below 3.0.0 is in the stated affected range, but the advisory is withdrawn as a duplicate of GHSA-pfhg-q3qv-9q6r.
Upgrade @sveltejs/kit to 3.0.0 or later, or follow the fix in GHSA-pfhg-q3qv-9q6r, the advisory this one duplicates.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references.
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
This page as .md · .json · in your agent: get_signal("GHSA-pvhg-7v4p-f5q9")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.