SvelteKit CVE-2026-82258

Exploitation requires that the target SvelteKit application uses the query.batch() API - applications running affected versions but not invoking this specific API are not exposed. The CVSS 4.0 vector specifies PR:L, confirming that the attacker must hold a valid authenticated session in the application; unauthenticated exploitation is not indicated. A concurrent request from a separate authenticated victim user must be in flight at the same moment, reflected in the UI:P metric; the attacker cannot trigger the race unilaterally. The AT:P metric further constrains exploitation to a specific timing prerequisite: the two requests must arrive within a narrow window in the batch processor's scheduling cycle. Limiting factors include: requirement for authenticated attacker and victim sessions, non-default API usage (query.batch() must be explicitly invoked), high timing precision required (AC:H), and higher risk only under meaningful concurrent load.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P, score 5.9 Medium) encodes several real constraints: high attack complexity from the race window, a specific prerequisite attack condition (AT:P) requiring the batch API to be in use, authenticated access (PR:L), and victim interaction (UI:P) in the form of a concurrent request. These collectively make reliable exploitation difficult - the attacker has limited control over the timing of another user's requests. No EPSS probability score was present in the source data, so quantitative exploitation likelihood cannot be stated; this is a gap in the available intelligence. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code appears in the referenced advisories, consistent with the low-to-moderate real-world urgency suggested by the Medium CVSS score. The confidentiality impact is rated high (VC:H), meaning that when the race does fire, the exposed data can be fully sensitive - a consequence that is disproportionate to the probability-adjusted risk. Applications with high concurrent authenticated user loads face meaningfully higher exposure than low-traffic deployments, where the race window may rarely or never be reached.

An authenticated attacker submits a query.batch() request to a SvelteKit 2.38.0-2.60.0 application timed to coincide with a concurrent request from a different authenticated user - for example, by repeatedly issuing batch requests during a high-traffic period to maximize overlap probability. The race condition causes the batch processor to resolve both users' data under a shared context, returning the victim's session data (such as profile fields, tokens, or application state) in the attacker's response. No public exploit code has been identified, and the narrow timing window makes reliable, on-demand triggering difficult.