Threats affecting pkg:github/sveltejs/kit

SvelteKit versions before 3.0.0 have a server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to exploit self-fetch fallbacks that automatically follow HTTP redirects. By manipulating the Host or forwarded headers, attackers can redirect fallback requests to internal services, potentially exposing them.

SvelteKit versions before 3.0.0 have a cross-site scripting (XSS) vulnerability in prerendered pages. This occurs because a cache-control header value set via setHeaders is inserted without proper escaping into a <meta http-equiv="cache-control"> tag. An attacker able to influence this untrusted value at prerender time can inject HTML or JavaScript that executes when users visit the page. The vulnerability is fixed in version 3.0.0.

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.