CVE-2026-114060— SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Quick assessment
Affected
sveltejs kit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SvelteKit（@sveltejs/kit）在 3.0.0 版本之前，其增强表单操作（use:enhance）中存在一个开放重定向漏洞，影响那些接受以双斜杠（//）开头的路径的路由。攻击者可构造以 // 起始的操作路径，使其被解析为协议相对 URL，从而导致非重定向的表单提交结果将受害者导航至攻击者控制的网站。
Possible ATT&CK Techniques 1 AI
T1566 · Phishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114060
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Source: CVE Program / CVE List V5
Vulnerability Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114060
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114060
请登录查看更多情报信息。
Other References for CVE-2026-114060 (2)
Same Patch Batch · sveltejs · 2026-10-21 · 4 CVEs total
| CVE-2026-114063 | 7.5 HIGH | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows |
| CVE-2026-114062 | 5.3 MEDIUM | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks |
| CVE-2026-114061 | 4.7 MEDIUM | SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages |
IV. Related Vulnerabilities
Same product: kit
-
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite previe -
CVE-2026-114062
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Sel -
CVE-2026-114061
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prere -
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deser -
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form De
Same vendor: sveltejs
-
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite previe -
CVE-2026-114062
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Sel -
CVE-2026-114061
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prere -
CVE-2026-92708
devalue: Cross-request process memory disclosure in devalue -
CVE-2026-81176
Svelte devalue: DoS via malformed input
Same weakness: CWE-601
-
CVE-2026-113384
Optimal IdM OptimalCloud social redirect -
CVE-2026-112251
antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequ -
CVE-2026-112040
diem-project diem Sign-In BasedmUserActions.class.php redire -
CVE-2026-112034
aircheng-org iWebShop-5 Login Redirect _userInfo.php redirec -
CVE-2026-111931
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Pr
V. Comments for CVE-2026-114060
No comments yet