{"id":"GHSA-pvhg-7v4p-f5q9","kind":"vulnerability","aliases":["GHSA-pvhg-7v4p-f5q9"],"related":[],"title":"Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references.\n\n## Original Description\nSvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.","summary":"SvelteKit's enhanced form actions (use:enhance) can be made to navigate the browser to an attacker-controlled site when an action path begins with a double slash. An attacker who can influence that path can send a victim to a phishing or malicious page.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","fixed":[],"affected":"< 3.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-601","next.js","package","self-hosted","svelte","sveltekit"],"not_affected_if":["no-use-enhance-forms","static-export"],"how_to_check":"Check the installed version with: npm ls @sveltejs/kit\nAny version below 3.0.0 is in the stated affected range, but the advisory is withdrawn as a duplicate of GHSA-pfhg-q3qv-9q6r.","fix":"Upgrade @sveltejs/kit to 3.0.0 or later, or follow the fix in GHSA-pfhg-q3qv-9q6r, the advisory this one duplicates.","status":"withdrawn","published_at":"2026-10-21T03:32:18+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:27+00:00","updated_at":"2026-10-23T21:00:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:00:27Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @sveltejs/kit to 3.0.0 or later, or follow the fix in GHSA-pfhg-q3qv-9q6r, the advisory this one duplicates.\nunknown","reach":"internet","impact":"low","summary":"SvelteKit's enhanced form actions (use:enhance) can be made to navigate the browser to an attacker-controlled site when an action path begins with a double slash. An attacker who can influence that path can send a victim to a phishing or malicious page.","category":"package","who_cares":["next.js","sveltekit","svelte","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Victim's browser navigates to an attacker-chosen external site","analyst_note":"Advisory is withdrawn as a duplicate; confirm the fixed version and details at GHSA-pfhg-q3qv-9q6r before acting on the affected range listed here.","how_to_check":"Check the installed version with: npm ls @sveltejs/kit\nAny version below 3.0.0 is in the stated affected range, but the advisory is withdrawn as a duplicate of GHSA-pfhg-q3qv-9q6r.\nunknown","needs_analyst":true,"not_affected_if":["static-export","no-use-enhance-forms"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000537,"input_tokens":2943,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-601':24B '3.0.0':5A,109C '7v4p':15A,20A '9q6r':95C 'accept':123C 'action':11A,36B,54B,118C,133C 'advisori':2A,79C,81C 'attack':49B,62B,130C,154C 'attacker-control':48B,153C 'becom':138C 'begin':56B,125C 'browser':45B 'caus':143C 'contain':110C 'control':50B,155C 'craft':132C 'cwe':23B 'descript':105C 'doubl':59B,128C 'duplic':1A,78C,89C 'enhanc':9A,34B,38B,116C,120C 'extern':102C 'f5q9':16A,21A 'form':10A,35B,117C,147C 'ghsa':13A,18A,92C 'ghsa-pfhg-q3qv-9q6r':91C 'ghsa-pvhg-7v4p-f5q9':12A,17A 'host':29B 'influenc':65B 'link':97C 'made':41B 'maintain':99C 'malici':76B 'navig':43B,150C 'next.js':25B 'non':145C 'non-redirect':144C 'open':6A,112C 'origin':104C 'packag':26B 'page':77B 'path':55B,67B,124C,134C 'pfhg':93C 'phish':74B 'preserv':101C 'protocol':140C 'protocol-rel':139C 'pvhg':14A,19A 'q3qv':94C 'redirect':7A,113C,146C 'refer':103C 'relat':141C 'result':148C 'rout':122C 'self':28B 'self-host':27B 'send':69B 'site':51B,156C 'slash':60B,129C 'start':135C 'svelt':30B 'sveltejs/kit':22A,107C 'sveltekit':3A,31B,32B,106C 'url':142C 'use':37B,119C 'via':8A 'victim':71B,151C 'vulner':114C 'withdrawn':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T03:32:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pvhg-7v4p-f5q9","url":"https://github.com/advisories/GHSA-pvhg-7v4p-f5q9","severity":"low","published_at":"2026-10-21T03:32:18+00:00","modified_at":"2026-10-23T20:57:39+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}