CVE-2024-53261 (Low) detected in kit-1.0.0-next.201.tgz

[mend-bolt-for-github]

CVE-2024-53261 - Low Severity Vulnerability

Vulnerable Library - kit-1.0.0-next.201.tgz

This is the [SvelteKit](https://kit.svelte.dev) framework and CLI.

Library home page: https://registry.npmjs.org/@sveltejs/kit/-/kit-1.0.0-next.201.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@sveltejs/kit/package.json

Dependency Hierarchy:

• ❌ kit-1.0.0-next.201.tgz (Vulnerable Library)

Found in HEAD commit: 04f495c91ab6c5c3804b30f9573d49c5e83a09e8

Found in base branch: master

Vulnerability Details

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from the request URL flows into "end", where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files "packages/kit/src/exports/vite/dev/index.js" and "packages/kit/src/exports/vite/utils.js" both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

Publish Date: 2024-11-25

URL: CVE-2024-53261

CVSS 3 Score Details (0.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rjjv-87mx-6x3h

Release Date: 2024-11-25

Fix Resolution: @sveltejs/kit - 2.8.3

---

Step up your Open Source Security Game with Mend here