{"id":"ghsa-ghsa-pfhg-q3qv-9q6r","seq":661320,"kind":"advisory","title":"SvelteKit: URL redirection to untrusted site via enhanced form submission","url":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pfhg-q3qv-9q6r","summary":"影響: npm:@sveltejs/kit < 3.0.0 → 3.0.0\nApplications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the curren…","severity":"low","techs":["nodejs","svelte"],"cves":["CVE-2026-114060"],"tags":["GHSA-pfhg-q3qv-9q6r","@sveltejs/kit"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:58:24.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}