CVE-2026-114061: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in sveltejs kit
Description
SvelteKit versions before 3.0.0 have a low-severity cross-site scripting (XSS) vulnerability in prerendered pages. This occurs because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker able to influence this untrusted value at prerender time can inject HTML or JavaScript that executes when users visit the page.
CVSS v4.0
Score 2.3low
Affected software
sveltejs
kit
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-114061 describes a cross-site scripting vulnerability in SvelteKit (@sveltejs/kit) versions prior to 3.0.0. The flaw arises from improper neutralization of input during web page generation: specifically, the cache-control header value set via setHeaders is inserted directly without escaping into a <meta http-equiv="cache-control"> tag in prerendered pages. This allows an attacker who can control the header value at prerender time to break out of the content attribute and inject arbitrary HTML or JavaScript, which executes in the context of users visiting the affected page.
Potential Impact
The vulnerability enables an attacker with the ability to influence the cache-control header value at prerender time to perform cross-site scripting attacks on users visiting the affected pages. This can lead to execution of arbitrary scripts in the victim's browser. The CVSS 4.0 score is 2.3, indicating low severity, reflecting limited attack complexity and impact.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid setting untrusted values in the cache-control header via setHeaders in prerendered pages or ensure proper escaping of such values before insertion.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:43:23.218Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c012cdf04f6568caa20
Added to database: 10/21/2026, 00:49:05 UTC
Last enriched: 10/21/2026, 01:33:55 UTC
Last updated: 10/21/2026, 02:28:18 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.