{"api_version":"1","generated_at":"2026-11-15T13:30:25+00:00","cve":"CVE-2026-128119","urls":{"html":"https://cve.report/CVE-2026-128119","api":"https://cve.report/api/cve/CVE-2026-128119.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-128119","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-128119"},"summary":{"title":"SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-13 20:18:56","updated_at":"2026-11-13 22:14:15"},"problem_types":["CWE-863","CWE-863 CWE-863: Incorrect Authorization"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x","name":"https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60","name":"https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1","name":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-128119","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128119","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"sveltejs","product":"kit","version":"affected >= 2.60.1, < 3.1.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"128119","cve":"CVE-2026-128119","epss":"0.002850000","percentile":"0.213010000","score_date":"2026-11-14","updated_at":"2026-11-15 00:06:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"kit","vendor":"sveltejs","versions":[{"status":"affected","version":">= 2.60.1, < 3.1.1"}]}],"descriptions":[{"lang":"en","value":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T19:32:58.899Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x"},{"name":"https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60"},{"name":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"}],"source":{"advisory":"GHSA-6cf5-gc4q-fm3x","discovery":"UNKNOWN"},"title":"SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-128119","datePublished":"2026-11-13T19:32:58.899Z","dateReserved":"2026-11-12T22:42:47.031Z","dateUpdated":"2026-11-13T19:32:58.899Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-13 20:18:56","lastModifiedDate":"2026-11-13 22:14:15","problem_types":["CWE-863","CWE-863 CWE-863: Incorrect Authorization"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"128119","Ordinal":"1","Title":"SvelteKit: Private `query.batch` functions could collide, produc","CVE":"CVE-2026-128119","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"128119","Ordinal":"1","NoteData":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.","Type":"Description","Title":"SvelteKit: Private `query.batch` functions could collide, produc"}]}}}