CVE-2026-114061 in SvelteKit
Summary
by MITRE • 10/22/2026
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in SvelteKit versions prior to 3.0.0 represents a critical cross-site scripting flaw rooted in improper input validation during the static site generation process. Specifically, this issue affects prerendered pages where developers utilize the setHeaders function to define HTTP headers for specific routes or global configurations. When these header values are subsequently rendered into HTML meta tags using an http-equiv attribute with cache-control as the property name, the framework fails to properly escape special characters within the untrusted input value. This lack of sanitization allows malicious actors who can influence the content of this header at prerender time to inject arbitrary scripts that execute in the context of any user visiting the generated page.
From a technical perspective, the core flaw lies in the direct interpolation of unsanitized data into an HTML attribute without encoding. In standard web application architecture, values placed within HTML attributes must be escaped to prevent them from being interpreted as structural markup or executable code. By inserting raw input directly into the content attribute of a meta tag, SvelteKit inadvertently creates a vector for script injection. An attacker can craft a payload that breaks out of the quoted string context using characters such as double quotes and angle brackets, thereby injecting JavaScript code that runs when the browser parses the HTML document. This is particularly dangerous because prerendered pages are often served statically via Content Delivery Networks or web servers without additional server-side validation at request time, meaning the malicious payload persists indefinitely until the site is rebuilt with a patched version of the framework.
The operational impact of this vulnerability is severe, primarily affecting user confidentiality and integrity through session hijacking, credential theft, or defacement. Since the injected script executes in the victim's browser context, it has full access to cookies, local storage, and other sensitive data associated with the domain. Attackers can leverage this capability to perform actions on behalf of authenticated users, redirect them to phishing sites, or manipulate page content dynamically. Furthermore, because the vulnerability exists at the prerendering stage, the malicious code is embedded directly into the static HTML files distributed to clients, making it difficult to mitigate through standard runtime security controls like Content Security Policy if not already strictly enforced and potentially bypassable depending on policy configuration.
This flaw aligns with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting vulnerability. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving client-side code injection and potentially stored XSS if the injected content is persisted in static assets served over time. The attack vector requires initial influence over the prerender configuration or environment variables that feed into the setHeaders function, suggesting that threat actors would need some level of access to the build process or deployment pipeline rather than just network-level interception during user requests.
To mitigate this vulnerability, organizations must immediately upgrade SvelteKit to version 3.0.0 or later where the issue has been resolved by implementing proper escaping mechanisms for header values before they are rendered into HTML attributes. For environments unable to update immediately due to dependency constraints, a temporary workaround involves manually ensuring that any data passed through setHeaders is sanitized using established encoding libraries such as DOMPurify or standard JavaScript escape functions like encodeURIComponent applied appropriately within custom middleware or hooks. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of successful injection attempts by restricting script execution sources and preventing inline scripts from running unless explicitly whitelisted. Regular auditing of build configurations and static asset generation processes is also recommended to detect similar patterns in other parts of the application stack where dynamic content might be improperly rendered into HTML structures without adequate sanitization.