HIGH8.8CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requests from 0, < 1.15.2
HIGH8.8CVE-2023-29003SvelteKit vulnerable to Cross-Site Request Forgery from 0, < 1.15.1
HIGH7.5CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKit >= 2.0.0, < 2.4.3
MEDIUM5.4@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
>= 2.0.0, < 2.20.6
MEDIUM4.2@sveltejs/kit has unescaped error message included on error page
from 0, < 2.8.3
NONE0.0@sveltejs/kit vulnerable to XSS on dev mode 404 page
from 0, < 2.8.3
—@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
from 0, < 2.57.1
—@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
from 0, < 2.57.1
—@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
>= 2.49.0, < 2.49.5
—SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
>= 2.19.0, < 2.49.5