CVE-2024-53262: @sveltejs/kit has unescaped error message included on error page

CVE-2024-53262 · Severity: medium · CVSS 4.2 · Published 2024-11-25

@sveltejs/kit is a popular web application framework used to build fast, reliable web apps. When an application explicitly generates custom error messages containing user input, an attacker could inject malicious JavaScript code that executes in the browser of anyone viewing the error page. Most applications are only vulnerable if they deliberately pass unsanitized user data into error messages.

Technologies: @sveltejs/kit (npm). Vendors: npm.

Quick answers

Is CVE-2024-53262 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-53262 being exploited in the wild.
How severe is CVE-2024-53262?
Medium severity, with a CVSS score of 4.2, published 25 November 2024.
Which products and versions are affected?
@sveltejs/kit (npm) < 2.8.3, SEMVER:introduced=0,fixed=2.8.3.
Is there a fix for CVE-2024-53262?
Yes. @sveltejs/kit (npm): upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-53262 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-53262?
Check whether you run @sveltejs/kit (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sveltejs/kit (npm): upgrade to 2.8.3 or later
    npm install @sveltejs/kit@2.8.3

Technical details

@sveltejs/kit's static error.html template uses placeholders like %sveltekit.error.message% that are replaced without HTML escaping. This is a cross-site scripting (XSS) vulnerability. An attacker can exploit it by crafting user input that, when explicitly passed to the error() function as the message parameter (e.g., error(500, '<script>alert("boom")</script>')), gets injected unescaped into the error page HTML. Precondition: the application must explicitly create errors with user-controlled message content—uncaught errors are not vulnerable as they always display "Internal error". The vulnerability allows arbitrary JavaScript execution in a victim's browser. A patch is available in version 2.8.3.

Affected products

  • SvelteJS Kit < 2.8.3

Identifiers

  • CVE-2024-53262
  • GHSA-mh2x-fcqh-fmqv

Timeline

  • 2024-11-25: disclosed
  • 2024-11-25: patched: Version 2.8.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.