{"id":"CVE-2026-114061","aliases":["GHSA-27mw-82g8-phjj"],"url":"https://o3.security/vulnerability/CVE-2026-114061","summary":"SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages","details":"### Impact\n\nApplications that prerender pages and use `setHeaders` to set a `cache-control` header from an untrusted source are vulnerable to cross-site scripting (XSS).\n\nSvelteKit inserts the header value into a `<meta http-equiv=\"cache-control\">` tag without escaping it. An attacker who can influence this value at prerender time can break out of the `content` attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.\n\n### Patches\n\nThe fix escapes the header value before inserting it into the generated HTML. Upgrade to `@sveltejs/kit` version 3.0.0 or later.\n\n### Workarounds\n\nAvoid forwarding untrusted `cache-control` header values with `setHeaders` on prerendered pages. Use a fixed, trusted cache policy instead.","published":"2026-10-21T00:36:35.456Z","modified":"2026-10-24T02:49:30.501374181Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@sveltejs/kit","fixedVersion":"3.0.0"}],"fix":{"url":"https://github.com/sveltejs/kit/commit/d9d55b579743c80ee7cb59c272d864fd9253dae7","label":"sveltejs/kit@d9d55b5"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114061.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114061"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages"},{"type":"WEB","url":"https://github.com/sveltejs/kit/commit/d9d55b579743c80ee7cb59c272d864fd9253dae7"},{"type":"PACKAGE","url":"https://github.com/sveltejs/kit"},{"type":"WEB","url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:49:30.501374181Z"}}