https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T07:02:39.192880+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-128121 CVE-2026-128121 — SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapt… 2026-11-15T07:02:39.193962+00:00

Affected: sveltejs kit, @sveltejs adapter-vercel, @sveltejs adapter-static

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.