GHSA-jf9x-2fg2-hx4wMediumCVSS 5.9
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
🔗 CVE IDs covered (1)
📋 Description
If an attacker could influence a link that was crawled during the prerender phase, that link could later be interpreted as a regex in the Vercel routing configuration.
🎯 Affected products4
- npm/@sveltejs/adapter-vercel:< 6.3.5
- npm/@sveltejs/adapter-static:>= 4.0.0-next.0, < 4.0.1
- npm/@sveltejs/adapter-vercel:>= 7.0.0-next.0, < 7.0.2
- npm/@sveltejs/adapter-static:< 3.0.11
🔗 References (9)
- https://github.com/sveltejs/kit/security/advisories/GHSA-jf9x-2fg2-hx4w
- https://github.com/sveltejs/kit/pull/17620
- https://github.com/sveltejs/kit/commit/0a2e58cbccdd46cac20aa5af4e2edf17e0da11dd
- https://github.com/sveltejs/kit/commit/2ed61a6aa3ac230b89e3528654c587847d1525a0
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
- https://github.com/advisories/GHSA-jf9x-2fg2-hx4w