CVE-2026-128116: SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script execution
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.70.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.1
Event History
Frequently Asked Questions
Which applications are affected?
Applications using SvelteKit with router.resolution set to 'server' are affected if they use a version earlier than 2.70.4 or 3.1.1. The issue occurs during client-side navigation when the navigated pathname begins with //.
What does an attacker need to exploit this?
An attacker needs to socially engineer a user into following a link that causes client-side navigation to a pathname beginning with //. No attacker privileges are required, but exploitation requires user interaction and a high-complexity attack condition.
What is the impact of successful exploitation?
Successful exploitation can cause the browser to import and execute JavaScript from another origin during server-side route resolution. The stated impact is exposure of confidential information; integrity and availability impacts are not indicated.
How can the issue be remediated?
Upgrade SvelteKit to version 2.70.4 or 3.1.1. These versions contain the fix for protocol-relative module specifiers being handled during client-side navigation.