{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "3.0.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "3.0.0"
                  }
                ],
                "source": "DESCRIPTION"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2ab20205163f303de3c850c2b618259440aabddd"
            }
          ],
          "repo": "https://github.com/sveltejs/kit",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-27mw-82g8-phjj"
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114061.json"
  },
  "details": "SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a \u003cmeta http-equiv=\"cache-control\"\u003e tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.",
  "id": "CVE-2026-114061",
  "modified": "2026-10-24T02:30:37.088557960Z",
  "published": "2026-10-21T00:36:35.456Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114061.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-27mw-82g8-phjj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114061"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-xss-via-cache-control-header-in-prerendered-pages"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages"
}