https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 10:15:29 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114061 <p>SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a &lt;meta http-equiv=&#34;cache-control&#34;&gt; tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.</p> <p>SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a &lt;meta http-equiv=&#34;cache-control&#34;&gt; tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114061 https://db.gcve.eu/vuln/ghsa-27mw-82g8-phjj <p><strong>Affected:</strong> npm: @sveltejs/kit</p> <p>### Impact</p> <p>Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).</p> <p>SvelteKit inserts the header value into a `&lt;meta http-equiv=&#34;cache-control&#34;&gt;` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.</p> <p>### Patches</p> <p>The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.</p> <p>### Workarounds</p> <p>Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.</p> <p><strong>Affected:</strong> npm: @sveltejs/kit</p> <p>### Impact</p> <p>Applications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).</p> <p>SvelteKit inserts the header value into a `&lt;meta http-equiv=&#34;cache-control&#34;&gt;` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.</p> <p>### Patches</p> <p>The fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.</p> <p>### Workarounds</p> <p>Avoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.</p> https://db.gcve.eu/vuln/ghsa-27mw-82g8-phjj