GHSA-85pr-xr59-r75h
Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Summary
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. ## Original Description SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | @sveltejs/kit | — | — |
Remediation: No patched version is listed by GitHub.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.