{"affected":[{"product":"kit","source":"CNA: GitHub_M","vendor":"sveltejs","versions":[{"status":"affected","version":"< 2.70.4"},{"status":"affected","version":">= 3.0.0, < 3.1.1"}]}],"cveId":"CVE-2026-128116","cwes":["CWE-79"],"description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794598024478,"publishedAt":1794598024478,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-rqp5-r3wg-vg35"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/pull/17620"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/a8f7c1e09f13524d3b71d814bad9c15c9f33ef49"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"}],"remediation":[],"revision":"812d5c956a45a3e21337fc2a0cdfef44b4791e31e3c7ebfcd87515dff67ce517","sources":[{"modifiedAt":1794598024478,"name":"CNA: GitHub_M","retrievedAt":1794600596750,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128116"}],"ssvc":null,"status":"published","title":"SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script execution","updatedAt":1794600596750}