GHSA-pvhg-7v4p-f5q9

Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Published

2026-10-21

Modified

2026-10-23

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references. ## Original Description SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-pvhg-7v4p-f5q9