UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128116

Protocol-relative module import during server-side route resolution allows cross-origin script execution

Severity
Medium 5.3
Published
29 Oct 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.70.4, 3.1.1
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Only under certain conditions · No login needed · Needs someone to click or open something
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Also known as
GHSA-rqp5-r3wg-vg35
Sources
CVE Program, Project advisories (GitHub)

Description

If an attacker could, using some form of social engineering or other exploit, get a user to use client-side navigation to navigate to a specially-crafted link, the attacker could cause code from another domain to be imported and run on the user's machine. This only affected apps with router.resolution: 'server'.

From sveltejs/kit's security advisory.

Affected software

SoftwareAffected versions
SvelteKitServers and applications · cna:sveltejs|kit
  • Every version before 2.70.4
  • From 3.0.0 before 3.1.1
SvelteKitServers and applications · github:sveltejs/kit
  • From 3.0.0 before 3.1.1

References