CVE-2026-114061— SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Quick assessment
Affected
sveltejs kit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SvelteKit（@sveltejs/kit）在 3.0.0 之前的版本中，预渲染页面存在跨站脚本（XSS）漏洞。该漏洞源于通过 设置的 响应头值，在未进行转义的情况下被直接插入到 标签中。若攻击者能够在预渲染阶段影响该不可信的值，即可突破 属性限制，注入 HTML 或 JavaScript 代码；当用户访问该页面时，这些恶意代码将被执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114061
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Source: CVE Program / CVE List V5
Vulnerability Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114061
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114061
请登录查看更多情报信息。
Other References for CVE-2026-114061 (2)
Same Patch Batch · sveltejs · 2026-10-21 · 4 CVEs total
| CVE-2026-114063 | 7.5 HIGH | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows |
| CVE-2026-114062 | 5.3 MEDIUM | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks |
| CVE-2026-114060 | 4.7 MEDIUM | SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions |
IV. Related Vulnerabilities
Same product: kit
-
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite previe -
CVE-2026-114062
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Sel -
CVE-2026-114060
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actio -
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deser -
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form De
Same vendor: sveltejs
-
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite previe -
CVE-2026-114062
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Sel -
CVE-2026-114060
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actio -
CVE-2026-92708
devalue: Cross-request process memory disclosure in devalue -
CVE-2026-81176
Svelte devalue: DoS via malformed input
Same weakness: CWE-79
-
CVE-2026-113741
itsourcecode Online Cake Ordering System 404.php cross site -
CVE-2026-94402
IBM vulnerable to cross-site scripting (XSS) via unsanitized -
CVE-2016-20102
JavaMelody < 1.60.0 Reflected XSS via monitoring graph param -
CVE-2014-125131
DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.p -
CVE-2014-125132
Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blog
V. Comments for CVE-2026-114061
No comments yet