@sveltejs/kit vulnerable to XSS on dev mode 404 page

Description

“Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).”

Recommendation

Update the @sveltejs/kit package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.8.3
• Patched version(s): 2.8.3

References

• GHSA-rjjv-87mx-6x3h
• CVE-2024-53261
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 5 - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 3 - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) 2 - CVE-2020-8203
• IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387

Tags:

npm

@sveltejs/kit