{"id":"CVE-2026-114061","aliases":["EUVD-2026-107012","GHSA-27mw-82g8-phjj","GHSA-85pr-xr59-r75h"],"status":"published","title":"SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00213,"percentile":0.11672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-21T00:36:35Z","modified":"2026-10-30T02:30:45Z","fixes":[{"ecosystem":"npm","package":"@sveltejs/kit","fixed_in":["3.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]}],"products":[{"vendor":"sveltejs","product":"kit"}],"references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114061","tags":["advisory"]},{"url":"https://github.com/sveltejs/kit/commit/d9d55b579743c80ee7cb59c272d864fd9253dae7","tags":["web"]},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27mw-82g8-phjj"},{"url":"https://github.com/advisories/GHSA-85pr-xr59-r75h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114061.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/kit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-114061","title":"SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"published","published":"2026-10-21T00:36:35.456Z","modified":"2026-10-28T15:19:51.281Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-107012","description":"SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"published","published":"2026-10-21T00:36:35Z","modified":"2026-10-28T15:19:51Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T16:59:20.750321Z"}],"ghsa":[{"id":"GHSA-27mw-82g8-phjj","title":"SvelteKit : XSS via untrusted cache-control header in prerendered page","description":"### Impact\n\nApplications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).\n\nSvelteKit inserts the header value into a `\u003cmeta http-equiv=\"cache-control\"\u003e` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.\n\n### Patches\n\nThe fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.\n\n### Workarounds\n\nAvoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.","status":"published","published":"2026-10-23T20:43:30Z","modified":"2026-10-23T20:43:31Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:35.723785Z"},{"id":"GHSA-85pr-xr59-r75h","title":"Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references.\n\n## Original Description\nSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"withdrawn","published":"2026-10-21T03:32:18Z","modified":"2026-10-23T20:43:08Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-114061","description":"SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"published","published":"2026-10-21T01:17:29.297Z","modified":"2026-10-28T16:17:04.41Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:02.045979Z"}],"osv":[{"id":"CVE-2026-114061","title":"SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"published","published":"2026-10-21T00:36:35.456Z","modified":"2026-10-30T02:30:45.789295863Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"GHSA-27mw-82g8-phjj","title":"SvelteKit : XSS via untrusted cache-control header in prerendered page","description":"### Impact\n\nApplications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).\n\nSvelteKit inserts the header value into a `\u003cmeta http-equiv=\"cache-control\"\u003e` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.\n\n### Patches\n\nThe fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.\n\n### Workarounds\n\nAvoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.","status":"published","published":"2026-10-23T20:43:30Z","modified":"2026-10-23T21:00:04.312966515Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GHSA-85pr-xr59-r75h","title":"Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references.\n\n## Original Description\nSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.","status":"withdrawn","published":"2026-10-21T03:32:18Z","modified":"2026-10-23T21:00:05.288003263Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}