SvelteKit: URL redirection to untrusted site via enhanced form submission

影響: npm:@sveltejs/kit < 3.0.0 → 3.0.0

Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the curren…

GitHub Advisory Databaseで読む

2026/10/24 05:58、GitHub Advisory Databaseが「SvelteKit: URL redirection to untrusted site via enhanced form submission」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js、Svelte。CVE: CVE-2026-114060。