CVE-2026-114061 json
SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
published 20d ago modified 12d ago also EUVD-2026-107012 , GHSA-27mw-82g8-phjj
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Patch / fix
- npm @sveltejs/kit 3.0.0
- sveltejs kit 3.0.0
Is CVE-2026-114061 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @sveltejs/kit | <3.0.0 |
3.0.0 |
Affected products
- sveltejs kit
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/sveltejs/kit/commit/d9d55b579743c80ee7cb59c272d864fd9253dae7
web
-
github.com
/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj
vendor-advisory, web
-
vulncheck.com
/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-114061
advisory
-
github.com
/sveltejs/kit
package
-
github.com
/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0
web
Sources
- CVE List CVE-2026-114061
- GitHub Advisory GHSA-27mw-82g8-phjj
- NVD CVE-2026-114061
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.