UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128119

Private `query.batch` functions could collide, producing unexpected parameter / function combinations

Severity
Medium 5.9
Published
29 Oct 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
3.1.1
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Also known as
GHSA-6cf5-gc4q-fm3x
Sources
CVE Program, Project advisories (GitHub)

Description

Under certain circumstances, private (non-exported) query.batch functions could end up sharing a batch, resulting in the arguments from one function being passed to another. This only affects apps using the experimental remote functions flag and non-exported query.batch functions.

From sveltejs/kit's security advisory.

Affected software

SoftwareAffected versions
SvelteKitServers and applications · cna:sveltejs|kit
  • From 2.60.1 before 3.1.1
SvelteKitServers and applications · github:sveltejs/kit
  • From 2.60.1 before 3.1.1

References