CVE-2024-53261

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.

• CWE-79

• https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438Patch
• https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3hThird Party Advisory

Published

Nov 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53256Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2024-53257Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-53258Autolab is a course management service that enables auto-gra…5.3
• CVE-2024-53259quic-go is an implementation of the QUIC protocol in Go. An …6.5
• CVE-2024-5326The Post Grid Gutenberg Blocks and WordPress Blog Plugin – P…8.8
• CVE-2024-53260Autolab is a course management service that enables auto-gra…6.8
• CVE-2024-53262SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53263Git LFS is a Git extension for versioning large files. When …8.5
• CVE-2024-53264bunkerweb is an Open-source and next-generation Web Applicat…5.1
• CVE-2024-53266Discourse is an open source platform for community discussio…5.4
• CVE-2024-53267sigstore-java is a sigstore java client for interacting with…5.5
• CVE-2024-53268Joplin is an open source, privacy-focused note taking app wi…8.8