{"affected":[{"product":"kit","source":"CNA: GitHub_M","vendor":"sveltejs","versions":[{"status":"affected","version":">= 3.0.0, < 3.1.1"}]}],"cveId":"CVE-2026-128118","cwes":["CWE-200","CWE-668"],"description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794598264678,"publishedAt":1794598264678,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-m9j8-jcmv-hp69"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/commit/ae07803806f75b8b5662ae4ab92934ca1356fd84"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"}],"remediation":[],"revision":"d17be2ed0835f4acb9988e0117dda51fb5285fda75824c2a5e7cd3a6ad5be07b","sources":[{"modifiedAt":1794598264678,"name":"CNA: GitHub_M","retrievedAt":1794600599405,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128118"}],"ssvc":null,"status":"published","title":"SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle","updatedAt":1794600599405}