SvelteKit Redirect, XSS, SSRF, and Path Traversal

A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remote attackers to read files outside the prerendered output directory, potentially exposing source code, configuration, or credentials readable by the server process. Exploitation requires the `vite preview` server to be running on a Windows host and reachable over the network or via a tunnel - a non-default posture, since the preview server is normally bound to localhost. Production deployments using adapter-node or static adapters, and hosts running POSIX/Linux/macOS, are not affected; no public exploit code has been identified at time of analysis, and impact is confined to confidentiality (no integrity or availability effect).

Server-side request forgery in SvelteKit before 3.0.0 allows unauthenticated remote attackers to abuse the framework's server-side self-fetch fallback as a redirect-following proxy, reaching internal services by influencing Host or forwarded headers. Exploitation requires that the application uses self-fetch fallbacks and that the attacker can control Host or X-Forwarded-Host/-Proto values, which is realistic behind a misconfigured or trusting reverse proxy; the resulting impact depends on which internal services are network-reachable. No public exploit identified at time of analysis, and the vendor-released fix is SvelteKit 3.0.0.

SvelteKit (@sveltejs/kit) versions before 3.0.0 can emit attacker-influenceable HTML or JavaScript into prerendered pages when an application passes untrusted data into a cache-control header via setHeaders; the value is inserted unescaped into a <meta http-equiv="cache-control"> tag. Exploitation requires a prerendered page plus an untrusted header value at prerender/build time, and the injected payload executes only when a user later visits that page (UI:P/UI:R), so impact is confined to the victim's browser context. This is a low-severity XSS issue (CVSS 2.3; assessed CVSS:3.1 vector with C:L/I:L), with no public exploit identified at time of analysis and no CISA KEV confirmation.

SvelteKit (@sveltejs/kit) before 3.0.0 can send a victim's browser to an attacker-controlled site when an enhanced form action (use:enhance) accepts an action path beginning with // and a non-redirect form result is used for navigation. The issue is a client-side open redirect (CWE-601) requiring a crafted link or form action plus victim interaction, and it does not compromise the SvelteKit server or expose application data; only off-site navigation is possible. No public exploit code was identified at time of analysis, and the CVSS v4 score is 2.1.