Description
Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).
SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.0
- Patched version(s): 3.0.0
References
Could your website be exposed too?
SmartScanner can check your website for SvelteKit : XSS via untrusted cache-control header in prerendered page and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
- SvelteKit: URL redirection to untrusted site via enhanced form submission - CVE-2026-114060
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026