# CVE-2024-53262: @sveltejs/kit has unescaped error message included on error page

Source: https://junglewise.ai/threats/cve-2024-53262-sveltejs-kit-unescaped-error-message-xss-on-error-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-53262 · Severity: medium · CVSS 4.2 · Published 2024-11-25

@sveltejs/kit is a popular web application framework used to build fast, reliable web apps. When an application explicitly generates custom error messages containing user input, an attacker could inject malicious JavaScript code that executes in the browser of anyone viewing the error page. Most applications are only vulnerable if they deliberately pass unsanitized user data into error messages.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-53262 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-53262 being exploited in the wild.

**How severe is CVE-2024-53262?** Medium severity, with a CVSS score of 4.2, published 25 November 2024.

**Which products and versions are affected?** @sveltejs/kit (npm) < 2.8.3, SEMVER:introduced=0,fixed=2.8.3.

**Is there a fix for CVE-2024-53262?** Yes. @sveltejs/kit (npm): upgrade to 2.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-53262 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-53262?** Check whether you run @sveltejs/kit (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sveltejs/kit (npm): upgrade to 2.8.3 or later

  ```sh
  npm install @sveltejs/kit@2.8.3
  ```


## Technical details

@sveltejs/kit's static error.html template uses placeholders like %sveltekit.error.message% that are replaced without HTML escaping. This is a cross-site scripting (XSS) vulnerability. An attacker can exploit it by crafting user input that, when explicitly passed to the error() function as the message parameter (e.g., error(500, '<script>alert("boom")</script>')), gets injected unescaped into the error page HTML. Precondition: the application must explicitly create errors with user-controlled message content—uncaught errors are not vulnerable as they always display "Internal error". The vulnerability allows arbitrary JavaScript execution in a victim's browser. A patch is available in version 2.8.3.

## Affected products

- SvelteJS Kit < 2.8.3

## Identifiers

- CVE-2024-53262
- GHSA-mh2x-fcqh-fmqv

## Timeline

- 2024-11-25: disclosed
- 2024-11-25: patched: Version 2.8.3

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv](https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/cve-2026-114060-sveltekit-sveltejs-kit-before-3-0-0-contains-an-open-redirect)
- [SvelteKit CPU exhaustion in remote form deserialization](https://junglewise.ai/threats/cve-2026-82261-sveltekit-cpu-exhaustion-in-remote-form-deserialization)