SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.

Affected: npm: @sveltejs/kit

### Impact

Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a `<meta http-equiv="cache-control">` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

### Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.

### Workarounds

Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.