CVE-2026-114062Medium· 5.3▾ SunlitSvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or fo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
kit < 3.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114060Medium· 4.7SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
CVE-2026-114061Medium· 4.7SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
CVE-2026-114063High· 7.5SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2023-29008High· 8.8SvelteKit framework has Insufficient CSRF protection for CORS requests
CVE-2025-61916High· 7.9Spinnaker is an open source, multi-cloud continuous delivery platform