CVE-2024-53262

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contain the following placeholders: %sveltekit.status% — the HTTP status, and %sveltekit.error.message% — the error message. This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content. Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable This issue has been addressed in version 2.8.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/sveltejs/kit/commit/134e36343ef57ed7e6e2b3bb9e7f05ad37865794Patch
• https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqvThird Party Advisory
• https://kit.svelte.dev/docs/errorsIssue Tracking

Published

Nov 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53257Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-53258Autolab is a course management service that enables auto-gra…5.3
• CVE-2024-53259quic-go is an implementation of the QUIC protocol in Go. An …6.5
• CVE-2024-5326The Post Grid Gutenberg Blocks and WordPress Blog Plugin – P…8.8
• CVE-2024-53260Autolab is a course management service that enables auto-gra…6.8
• CVE-2024-53261SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53263Git LFS is a Git extension for versioning large files. When …8.5
• CVE-2024-53264bunkerweb is an Open-source and next-generation Web Applicat…5.1
• CVE-2024-53266Discourse is an open source platform for community discussio…5.4
• CVE-2024-53267sigstore-java is a sigstore java client for interacting with…5.5
• CVE-2024-53268Joplin is an open source, privacy-focused note taking app wi…8.8
• CVE-2024-53269Envoy is a cloud-native high-performance edge/middle/service…7.5