SvelteKit: URL redirection to untrusted site via enhanced form submission
影響: npm:@sveltejs/kit < 3.0.0 → 3.0.0
Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the curren…
| CVE | CVE-2026-114060 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 05:58, GitHub Advisory Database에서 "SvelteKit: URL redirection to untrusted site via enhanced form submission"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js, Svelte. CVE: CVE-2026-114060.