CVE-2026-114060: URL Redirection to Untrusted Site ('Open Redirect') in sveltejs kit

CVE-2026-114060 is an open redirect vulnerability in SvelteKit (@sveltejs/kit) versions prior to 3.0.0. It occurs in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash (//). Attackers can exploit this by crafting action paths starting with //, which become protocol-relative URLs. This causes form results that are not intended to redirect to instead navigate victims to attacker-controlled external sites.

The vulnerability enables attackers to redirect users to untrusted external sites via crafted form action paths. This can be used in phishing or social engineering attacks to trick users into visiting malicious websites. The CVSS score of 2.1 indicates a low severity impact with network attack vector, low complexity, and requiring user interaction.

No explicit patch or remediation details are provided in the input data. Since the affected versions are all versions prior to 3.0.0, upgrading to version 3.0.0 or later is implied as the fix. Users should verify with the official SvelteKit vendor advisory for patch availability and apply the official fix when available.