Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | < 2.70.4, >= 3.0.0-next.0, < 3.1.1 | — |
| @sveltejs | adapter-vercel | < 6.3.5, >= 7.0.0-next.0, < 7.0.2 | — |
| @sveltejs | adapter-static | < 3.0.11, >= 4.0.0-next.0, < 4.0.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sveltejs/adapter-static | >= 4.0.0-next.0, < 4.0.1 | 4.0.1 | GHSA-jf9x-2fg2-hx4w |
| npm | @sveltejs/adapter-static | < 3.0.11 | 3.0.11 | GHSA-jf9x-2fg2-hx4w |
| npm | @sveltejs/adapter-vercel | < 6.3.5 | 6.3.5 | GHSA-jf9x-2fg2-hx4w |
| npm | @sveltejs/adapter-vercel | >= 7.0.0-next.0, < 7.0.2 | 7.0.2 | GHSA-jf9x-2fg2-hx4w |
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-jf9x-2fg2-hx4w
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/2ed61a6aa3ac230b89e3528654c587847d1525a0
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@3.0.11
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-static@4.0.1
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-vercel@6.3.5
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/adapter-vercel@7.0.2