{"id":"GHSA-rqp5-r3wg-vg35","kind":"vulnerability","aliases":["GHSA-rqp5-r3wg-vg35"],"related":[],"title":"Protocol-relative module import during server-side route resolution allows cross-origin script execution","description":"If an attacker could, using some form of social engineering or other exploit, get a user to use client-side navigation to navigate to a specially-crafted link, the attacker could cause code from another domain to be imported and run on the user's machine. This only affected apps with `router.resolution: 'server'`.","summary":"A crafted link can make SvelteKit's client-side navigation import and run a script from a different domain. An attacker who gets a user to click such a link can run code in that user's browser session.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sveltejs/kit","note":"<= 2.70.3, >= 3.0.0, <=3.1.0","fixed":["2.70.4","3.1.1"],"affected":"<= 2.70.3, >= 3.0.0, <= 3.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","npm","package","svelte","sveltekit"],"not_affected_if":["default-config","no-server-route-resolution"],"how_to_check":"- Look for `router.resolution: 'server'` in the SvelteKit config file (`svelte.config.js`); apps without it are not affected.\n- Check the installed version with `npm ls @sveltejs/kit`; versions `<= 2.70.3` and `>= 3.0.0 <= 3.1.0` are affected.","fix":"- `@sveltejs/kit` `2.70.4` for the 2.x line\n- `@sveltejs/kit` `3.1.1` for the 3.x line","status":"open","published_at":"2026-10-29T23:47:38+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:56:36+00:00","updated_at":"2026-11-09T22:56:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:56:36Z","model":"claude-haiku-5-5","output":{"fix":"- `@sveltejs/kit` `2.70.4` for the 2.x line\n- `@sveltejs/kit` `3.1.1` for the 3.x line","reach":"internet","title":"SvelteKit: crafted link runs code from another domain in browsers","impact":"medium","summary":"A crafted link can make SvelteKit's client-side navigation import and run a script from a different domain. An attacker who gets a user to click such a link can run code in that user's browser session.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltekit","svelte","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker script runs in user's browser via cross-origin import","analyst_note":"","how_to_check":"- Look for `router.resolution: 'server'` in the SvelteKit config file (`svelte.config.js`); apps without it are not affected.\n- Check the installed version with `npm ls @sveltejs/kit`; versions `<= 2.70.3` and `>= 3.0.0 <= 3.1.0` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-server-route-resolution"],"who_is_affected":"Only apps that set `router.resolution: 'server'` are exposed, because the flaw is in how server-side route resolution builds the module import path. Apps using the default client-side resolution are not affected according to the advisory. Teams that run SvelteKit apps with that setting should upgrade.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4644,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-79':30B 'affect':125C 'allow':12A 'anoth':111C 'app':126C 'attack':56B,77C,106C 'browser':73B 'caus':108C 'click':62B 'client':43B,94C 'client-sid':42B,93C 'code':68B,109C 'could':78C,107C 'craft':36B,103C 'cross':14A 'cross-origin':13A 'cwe':29B 'differ':53B 'domain':54B,112C 'engin':84C 'execut':17A 'exploit':87C 'form':81C 'get':58B,88C 'ghsa':19A,24A 'ghsa-rqp5-r3wg-vg35':18A,23A 'import':5A,46B,115C 'link':37B,65B,104C 'machin':122C 'make':39B 'modul':4A 'navig':45B,96C,98C 'npm':31B 'origin':15A 'packag':32B 'protocol':2A 'protocol-rel':1A 'r3wg':21A,26A 'relat':3A 'resolut':11A 'rout':10A 'router.resolution':128C 'rqp5':20A,25A 'run':48B,67B,117C 'script':16A,50B 'server':8A,129C 'server-sid':7A 'session':74B 'side':9A,44B,95C 'social':83C 'special':102C 'specially-craft':101C 'svelt':33B 'sveltejs/kit':28A 'sveltekit':34B,40B 'use':79C,92C 'user':60B,71B,90C,120C 'vg35':22A,27A","nicknames":[],"mitigations":[],"who_affected":"Only apps that set `router.resolution: 'server'` are exposed, because the flaw is in how server-side route resolution builds the module import path. Apps using the default client-side resolution are not affected according to the advisory. Teams that run SvelteKit apps with that setting should upgrade.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["kit"],"ptokens":["kit","sveltejs"],"labels":["cwe79","medium","npm","package","svelte","sveltekit"],"campaign_type":null,"search_a":"'allow':12A 'cross':14A 'cross-origin':13A 'execut':17A 'ghsa':19A,24A 'ghsa-rqp5-r3wg-vg35':18A,23A 'import':5A 'modul':4A 'origin':15A 'protocol':2A 'protocol-rel':1A 'r3wg':21A,26A 'relat':3A 'resolut':11A 'rout':10A 'rqp5':20A,25A 'script':16A 'server':8A 'server-sid':7A 'side':9A 'sveltejs/kit':28A 'vg35':22A,27A","search_b":"'-79':30B 'attack':56B 'browser':73B 'click':62B 'client':43B 'client-sid':42B 'code':68B 'craft':36B 'cwe':29B 'differ':53B 'domain':54B 'get':58B 'import':46B 'link':37B,65B 'make':39B 'navig':45B 'npm':31B 'packag':32B 'run':48B,67B 'script':50B 'session':74B 'side':44B 'svelt':33B 'sveltekit':34B,40B 'user':60B,71B","search_c":"'affect':125C 'anoth':111C 'app':126C 'attack':77C,106C 'caus':108C 'client':94C 'client-sid':93C 'code':109C 'could':78C,107C 'craft':103C 'domain':112C 'engin':84C 'exploit':87C 'form':81C 'get':88C 'import':115C 'link':104C 'machin':122C 'navig':96C,98C 'router.resolution':128C 'run':117C 'server':129C 'side':95C 'social':83C 'special':102C 'specially-craft':101C 'use':79C,92C 'user':90C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T23:47:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rqp5-r3wg-vg35","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-rqp5-r3wg-vg35","severity":"medium","published_at":"2026-10-29T23:47:38+00:00","modified_at":"2026-10-29T23:47:38+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":110417,"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-rqp5-r3wg-vg35","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}