Description (CNA)
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sveltejs / kit | affected 0 before 3.0.0; unaffected 3.0.0 |
CWE
CWE-601
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r
- https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions
ADP enrichment
No English description supplied.
No references supplied.