CVE-2026-128119
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.