---
id: GHSA-pvhg-7v4p-f5q9
title: >-
  Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form
  Actions
summary: >-
  Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form
  Actions
severity: low
cvss: 4.7
cwe:
  - CWE-601
vendor: sveltejs
product: '@sveltejs/kit'
ecosystem: npm
affected:
  - '@sveltejs/kit < 3.0.0'
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:57:39Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pvhg-7v4p-f5q9'
references:
  - url: 'https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114060'
  - url: >-
      https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions
  - url: 'https://github.com/advisories/GHSA-pvhg-7v4p-f5q9'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-23T21:38:13.037Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references.

## Original Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

## Affected packages

- `@sveltejs/kit < 3.0.0`

## Remediation

Refer to the advisory for the patched release.