Known Vulnerabilities for Sveltekit by Svelte
Listed below are 8 of the newest known vulnerabilities associated with "Sveltekit" by "Svelte".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-114063 json | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Wind... | Not Provided | 2026-10-21 | 2026-10-27 |
| CVE-2026-114062 json | SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal se... | Not Provided | 2026-10-21 | 2026-10-22 |
| CVE-2026-114061 json | SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-con... | Not Provided | 2026-10-21 | 2026-10-28 |
| CVE-2026-114060 json | SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on rout... | Not Provided | 2026-10-21 | 2026-10-21 |
| CVE-2026-92708 json | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. ... | Not Provided | 2026-09-18 | 2026-09-23 |
| CVE-2026-82261 json | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU ex... | Not Provided | 2026-08-28 | 2026-10-08 |
| CVE-2026-82260 json | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) an... | Not Provided | 2026-08-28 | 2026-10-08 |
| CVE-2026-82259 json | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental... | Not Provided | 2026-08-28 | 2026-10-08 |
| CVE-2026-82258 json | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from dif... | Not Provided | 2026-08-28 | 2026-10-08 |
| CVE-2026-82257 json | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields ... | Not Provided | 2026-08-28 | 2026-10-08 |