@sveltejs/kit has unescaped error message included on error page

Description

The static error.html template for errors contains placeholders that are replaced without escaping the content first.

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

Affected version(s): < 2.8.3
Patched version(s): 2.8.3

References

GHSA-mh2x-fcqh-fmqv
kit.svelte.dev
CVE-2024-53262
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for @sveltejs/kit has unescaped error message included on error page and gives you actionable findings to investigate.

Start a free scan

Related Issues

@sveltejs/kit vulnerable to XSS on dev mode 404 page - CVE-2024-53261
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
socket.io has an unhandled 'error' event - CVE-2024-38355
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated November 25, 2024