CVE-2024-53262: @sveltejs/kit has unescaped error message included on error page
(updated )
The static error.html template for errors contains placeholders that are replaced without escaping the content first.
References
- github.com/advisories/GHSA-mh2x-fcqh-fmqv
- github.com/sveltejs/kit/commit/134e36343ef57ed7e6e2b3bb9e7f05ad37865794
- github.com/sveltejs/kit/pull/13050
- github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.8.3
- github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv
- kit.svelte.dev/docs/errors
- nvd.nist.gov/vuln/detail/CVE-2024-53262
Code Behaviors & Features
Detect and mitigate CVE-2024-53262 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →