PT-2026-20880 · Svelte · @Sveltejs/Adapter-Vercel

Elliott-With-The-Longest-Name-On-Github · Published 2026-02-19 · Updated 2026-02-20 · CVE-2026-27118

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @sveltejs/adapter-vercel versions prior to 6.3.2

Description @sveltejs/adapter-vercel is a framework used for developing web applications with Svelte. A flaw exists where an internal query parameter, designed for Incremental Static Regeneration (ISR), is accessible across all routes. This allows an attacker to manipulate the caching mechanism, potentially serving sensitive, user-specific responses to unintended recipients. Exploitation requires a user to access a malicious link while logged in. While Vercel’s Web Application Firewall (WAF) provides some protection for existing deployments, upgrading is recommended. Incremental Static Regeneration (ISR) is a technique that allows you to update static content after you've built your site.

Recommendations Upgrade @sveltejs/adapter-vercel to version 6.3.2 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-27118

GHSA-9PQ4-5HCF-288C

Affected Products

@Sveltejs/Adapter-Vercel

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27118.json · Exploit
• https://osv.dev/vulnerability/GHSA-9pq4-5hcf-288c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27118 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27118 · Vendor Advisory
• https://github.com/sveltejs/kit · Note
• https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c · Note
• https://twitter.com/CVEnew/status/2024988747650269450 · Twitter Post