GHSA-5wg4-q3ww-283hMediumCVSS 5.9
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
🔗 CVE IDs covered (1)
📋 Description
If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.
🎯 Affected products2
- npm/@sveltejs/adapter-cloudflare:>= 4.7.0, < 7.2.10
- npm/@sveltejs/adapter-cloudflare:>= 8.0.0-next.0, < 8.0.2
🔗 References (7)
- https://github.com/sveltejs/kit/security/advisories/GHSA-5wg4-q3ww-283h
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/679e0d84ea9951bb4f1e458a599066b5a451b08a
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/advisories/GHSA-5wg4-q3ww-283h