← Vulnerability feed

Vulnerability record · CVE-2024-53261 · published 25 November 2024

CVE-2024-53261: Sveltekit cross-site scripting vulnerability

Svelte · Sveltekit

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

2.0 CVSS 4.0 Low EPSS 0.33% · top 76.4% CWE-79 · Cross-site scripting
2.0CVSS 4.0 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438 Patch
https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h Third Party Advisory

Track CVE-2024-53261 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-29008Sveltekit server-side request forgery (ssrf) vulnerabilityThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint han…EPSS 0.37%8.8CVE-2023-29003Sveltekit cross-site request forgery vulnerabilitySvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a …EPSS 0.56%8.7CVE-2026-82260Sveltekit uncontrolled resource consumption vulnerabilitySvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a…EPSS 0.49%8.7CVE-2026-82261Sveltekit uncontrolled resource consumption vulnerabilitySvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability i…EPSS 0.49%8.7CVE-2026-82259Sveltekit deserialization of untrusted data vulnerabilitySvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. W…EPSS 0.53%6.9CVE-2026-82256Sveltekit uncontrolled resource consumption vulnerabilitySvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large …EPSS 0.42%5.9CVE-2026-82258Sveltekit race condition vulnerabilitySvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge un…EPSS 0.24%5.3CVE-2026-82257Sveltekit prototype pollution vulnerabilitySvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary us…EPSS 0.36%

Source: NIST National Vulnerability Database (record CVE-2024-53261), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.