https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 10:15:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114060 <p>SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.</p> <p>SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114060 https://db.gcve.eu/vuln/ghsa-pfhg-q3qv-9q6r <p><strong>Affected:</strong> npm: @sveltejs/kit</p> <p>### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.</p> <p>### Patches A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.</p> <p>The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.</p> <p>### Workarounds Reject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.</p> <p>Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:</p> <p>```svelte &lt;form method=&#34;POST&#34; use:enhance={() =&gt; ({ update }) =&gt; update({ navigate: false })}&gt; &lt;!-- form fields --&gt; &lt;/form&gt; ```</p> <p>This applies non-redirect results to the current page instead of navigating to the action location.</p> <p><strong>Affected:</strong> npm: @sveltejs/kit</p> <p>### Impact Applications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.</p> <p>### Patches A fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.</p> <p>The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.</p> <p>### Workarounds Reject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.</p> <p>Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:</p> <p>```svelte &lt;form method=&#34;POST&#34; use:enhance={() =&gt; ({ update }) =&gt; update({ navigate: false })}&gt; &lt;!-- form fields --&gt; &lt;/form&gt; ```</p> <p>This applies non-redirect results to the current page instead of navigating to the action location.</p> https://db.gcve.eu/vuln/ghsa-pfhg-q3qv-9q6r