CVE-2026-114060 in kit
Summary
by MITRE • 10/22/2026
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the SvelteKit framework prior to version 3.0.0, specifically affecting the handling of enhanced form actions implemented via the use:enhance directive. This vulnerability manifests when routes accept URL paths that begin with a double slash sequence. In web development standards, a path starting with two forward slashes is interpreted as a protocol-relative URL rather than an absolute or relative path within the current domain structure. When such a path is processed by the framework's routing and navigation logic without adequate validation, it triggers unintended browser behavior during form submission events that are managed client-side through SvelteKit enhancements.
From a technical perspective, the core issue stems from insufficient sanitization of user-supplied input used to construct redirect targets or action endpoints. When an attacker crafts a malicious payload where the target path begins with // followed by a domain name controlled by the adversary, the browser interprets this as http:// or https:// depending on the current page's protocol. Consequently, instead of performing an internal navigation or returning a standard response within the application context, the client-side router initiates a full-page navigation to the external site specified in the double-slash path. This mechanism effectively bypasses same-origin policy protections because the redirection is executed by the user agent itself based on malformed input rather than through server-side enforcement of safe redirect lists.
The operational impact of this vulnerability allows for open redirect attacks, which are frequently leveraged as a vector for phishing campaigns and credential theft. An attacker can embed the malicious URL within a legitimate-looking link or form submission trigger hosted on the vulnerable SvelteKit application. When an unsuspecting user interacts with the compromised element, they are seamlessly redirected to a fraudulent website that mimics the appearance of the original service or other trusted entities. This erosion of trust facilitates social engineering attacks where victims may inadvertently disclose sensitive information such as login credentials, session tokens, or personal data on the attacker-controlled domain. Furthermore, this vulnerability can be combined with cross-site scripting if additional context allows script injection in redirect targets, although the primary risk here is direct navigation to malicious infrastructure.
This flaw aligns closely with Common Weakness Enumeration identifier CWE-601, which defines URL redirection to untrusted site as an open redirect weakness. The exploitation technique corresponds to ATT&CK tactic TA0005 Defense Evasion and specifically relates to techniques involving domain fronting or phishing via legitimate domains, often categorized under social engineering tactics in the broader attack lifecycle. To mitigate this risk, developers must ensure that all form action paths are strictly validated against a whitelist of allowed internal routes before being processed by the enhanced navigation logic. Implementing server-side validation is critical because client-side checks can be bypassed or manipulated if the framework relies solely on browser behavior for security decisions. Additionally, upgrading to SvelteKit version 3.0.0 or later resolves this issue as it includes patches that properly sanitize and validate path inputs to prevent protocol-relative URL interpretation in form actions.