CVE-2024-53261

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438	Patch
https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:svelte:sveltekit:*:*:*:*:*:node.js:*:*

History

28 Aug 2025, 14:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:svelte:sveltekit::::::node.js::*
References	~~() https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438 -~~	() https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438 - Patch
References	~~() https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h -~~	() https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
First Time		Svelte sveltekit Svelte

Information

Published : 2024-11-25 20:15

Updated : 2025-08-28 14:34

NVD link : CVE-2024-53261

Mitre link : CVE-2024-53261

CVE.ORG link : CVE-2024-53261

JSON object : View

Products Affected

svelte

sveltekit

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-53261", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-11-25T20:15:10.217", "references": [{"url": "https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. \"Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).\" The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade."}, {"lang": "es", "value": "SvelteKit es un framework de trabajo para desarrollar r\u00e1pidamente aplicaciones web robustas y de alto rendimiento utilizando Svelte. \"La entrada no higienizada de *la URL de solicitud* fluye hacia `end`, donde se utiliza para mostrar una p\u00e1gina HTML que se devuelve al usuario. Esto puede resultar en un ataque de cross-site scripting (XSS)\". Los archivos `packages/kit/src/exports/vite/dev/index.js` y `packages/kit/src/exports/vite/utils.js` contienen datos controlables por el usuario que, en condiciones espec\u00edficas, pueden fluir a p\u00e1ginas en modo de desarrollo. El impacto esperado es m\u00ednimo o nulo. El desarrollo de Vite no est\u00e1 expuesto a la red de forma predeterminada e incluso si alguien pudiera enga\u00f1ar a un desarrollador para que ejecute un XSS contra s\u00ed mismo, una base de datos de desarrollo no deber\u00eda tener ning\u00fan dato confidencial. No obstante, este problema se ha solucionado en la versi\u00f3n 2.8.3 y se recomienda a todos los usuarios que actualicen."}], "lastModified": "2025-08-28T14:34:39.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:svelte:sveltekit:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2588130D-C9C2-47BC-B565-571E28BA17A8", "versionEndExcluding": "2.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}