CVE-2026-114061
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Oct 21, 2026
Vendor
unknown
Description
SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.