CVE-2026-114061 — SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted wit…
Published: 2026-10-21 · CVSS: 2.3 · CVSS 4.0
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7