Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | 3.0.0, < 3.1.1 | — |
| sveltejs | kit | < 2.70.4 | — |
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-rqp5-r3wg-vg35
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/a8f7c1e09f13524d3b71d814bad9c15c9f33ef49
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1