{"id":"CVE-2026-114060","aliases":["GHSA-pfhg-q3qv-9q6r"],"title":"SvelteKit: URL redirection to untrusted site via enhanced form submission","summary":"SvelteKit: URL redirection to untrusted site via enhanced form submission","severity":"low","cvss":4.7,"cwe":["CWE-601"],"vendor":"sveltejs","product":"@sveltejs/kit","ecosystem":"npm","affected":["@sveltejs/kit < 3.0.0"],"patched":["@sveltejs/kit 3.0.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T20:58:25Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r","references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114060"},{"url":"https://github.com/sveltejs/kit/commit/91aae3547c6cd2935d79c09a53e27c740100000a"},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.0.0"},{"url":"https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions"},{"url":"https://github.com/advisories/GHSA-pfhg-q3qv-9q6r"}],"tags":["ghsa","npm","cve.org"],"epss":0.00202,"epssPercentile":0.09987,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T14:24:55.358151Z"},"ingestedAt":"2026-10-21T01:37:08.047Z","slug":"CVE-2026-114060","body":"## Overview\n\n### Impact\nApplications using enhanced form actions (`use:enhance`) on routes that accept paths beginning with `//`, such as catch-all routes, may be vulnerable to an open redirect.\n\n### Patches\nA fix has been prepared for `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.\n\nThe fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.\n\n### Workarounds\nReject requests whose parsed URL pathname begins with `//` before route resolution, for example in a reverse proxy or a SvelteKit `handle` hook.\n\nAlternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:\n\n```svelte\n<form method=\"POST\" use:enhance={() => ({ update }) => update({ navigate: false })}>\n  <!-- form fields -->\n</form>\n```\n\nThis applies non-redirect results to the current page instead of navigating to the action location.\n\n## Affected packages\n\n- `@sveltejs/kit < 3.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@sveltejs/kit 3.0.0`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228369,"id":"CVE-2026-114060","ts":1792791529857,"field":"severity","old":"medium","new":"low"}]}