Description (CNA)
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| sveltejs / kit | affected 2.38.0 before 2.60.1; unaffected 2.60.1 |
CWE
CWE-362
References
- https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr
- https://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch
ADP enrichment
No English description supplied.
No references supplied.