PT-2024-35700 · Sveltekit · Sveltekit

Dominikg · Published 2024-11-25 · Updated 2025-08-28 · CVE-2024-53262

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 2.8.3

Description The static error.html template for errors in SvelteKit contains placeholders that are replaced without escaping the content first. This leads to possible injection if an app explicitly creates an error with a message that contains user-controlled content. The error.html page can contain placeholders such as %sveltekit.status% for the HTTP status and %sveltekit.error.message% for the error message. Only applications where user-provided input is used in the Error message will be vulnerable.

Recommendations For versions prior to 2.8.3, upgrade to version 2.8.3 or later to address this issue. As a temporary workaround, consider escaping the message string in the function that creates the HTML output to improve safety for applications that are using custom errors on the server. Restrict the use of user-provided input in the Error message to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53262

GHSA-MH2X-FCQH-FMQV

Affected Products

Sveltekit

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53262.json · Exploit
• https://github.com/sveltejs/kit/commit/134e36343ef57ed7e6e2b3bb9e7f05ad37865794 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53262 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mh2x-fcqh-fmqv · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv · Note
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.8.3 · Note
• https://github.com/sveltejs/kit/pull/13050 · Note
• https://kit.svelte.dev/docs/errors · Note
• https://t.me/cveNotify/133833 · Telegram Post
• https://twitter.com/CVEnew/status/1861128998220120460 · Twitter Post