# SvelteKit open redirect in enhanced form actions

Source: https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-open-redirect-via-enhanced-9a8dcd94  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4.7 · Published 2026-10-21

SvelteKit is a web framework for building modern JavaScript applications. An open redirect vulnerability in enhanced form submission (use:enhance) allows attackers to craft malicious action paths that redirect users to attacker-controlled websites. This can be used for phishing attacks or to direct users away from legitimate services.

Technologies: [@sveltejs/kit (npm)](https://junglewise.ai/threats/technologies/sveltejs-kit), [SvelteKit](https://junglewise.ai/threats/technologies/sveltekit). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4.7, published 21 October 2026.

**Which products and versions are affected?** @sveltejs/kit (npm) < 3.0.0, SEMVER:introduced=0; SvelteKit before 3.0.0.

**Is there a fix for This vulnerability?** Yes: fixed in 3.0.0. Until then: Reject requests whose parsed URL pathname begins with // before route resolution (e.g., in a reverse proxy or SvelteKit handle hook). Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate: false.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-05"}, {"kind":"patched", "at":"2026-10-21"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

Reject requests whose parsed URL pathname begins with // before route resolution (e.g., in a reverse proxy or SvelteKit handle hook). Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback that sets navigate: false.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-05"}, {"kind":"patched", "at":"2026-10-21"}]

## Technical details

The vulnerability exists in SvelteKit's enhanced form action handling on routes accepting paths beginning with double slashes (//). Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites. This requires user interaction (form submission) and affects versions before 3.0.0.

## Affected products

- Svelte SvelteKit before 3.0.0

## References

- [https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r](https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r)

## Related threats

- [SvelteKit XSS via cache-control header in prerendered pages](https://junglewise.ai/threats/duplicate-advisory-sveltekit-before-3-0-0-xss-via-cache-control-header-5731f4e1)
- [SvelteKit path traversal in vite preview server on Windows](https://junglewise.ai/threats/cve-2026-114063-sveltekit-sveltejs-kit-from-2-10-0-before-3-0-0-contains-a-path)
- [SvelteKit server-side request forgery in self-fetch fallbacks](https://junglewise.ai/threats/cve-2026-114062-sveltekit-before-3-0-0-contains-a-server-side-request-forgery)
- [SvelteKit cross-site scripting in prerendered pages](https://junglewise.ai/threats/cve-2026-114061-sveltekit-sveltejs-kit-before-3-0-0-contains-a-cross-site)
- [SvelteKit open redirect in enhanced form actions](https://junglewise.ai/threats/cve-2026-114060-sveltekit-sveltejs-kit-before-3-0-0-contains-an-open-redirect)