Description
Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.0
- Patched version(s): 3.0.0
References
Could your website be exposed too?
SmartScanner can check your website for SvelteKit: URL redirection to untrusted site via enhanced form submission and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SvelteKit : XSS via untrusted cache-control header in prerendered page - CVE-2026-114061
- SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
- Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) - CVE-2026-73088
- [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/debug - CVE-2026-44691
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026