Executive brief
@sveltejs/kit is a popular web application framework used to build fast, reliable web apps. When an application explicitly generates custom error messages containing user input, an attacker could inject malicious JavaScript code that executes in the browser of anyone viewing the error page. Most applications are only vulnerable if they deliberately pass unsanitized user data into error messages.
Technical details
@sveltejs/kit's static error.html template uses placeholders like %sveltekit.error.message% that are replaced without HTML escaping. This is a cross-site scripting (XSS) vulnerability. An attacker can exploit it by crafting user input that, when explicitly passed to the error() function as the message parameter (e.g., error(500, '<script>alert("boom")</script>')), gets injected unescaped into the error page HTML. Precondition: the application must explicitly create errors with user-controlled message content—uncaught errors are not vulnerable as they always display "Internal error". The vulnerability allows arbitrary JavaScript execution in a victim's browser. A patch is available in version 2.8.3.
Affected products
- SvelteJS Kit < 2.8.3
Timeline
- 2024-11-25: disclosed
- 2024-11-25: patched: Version 2.8.3