{"items":[{"id":"NVI-00012007","kind":"vulnerability","title":"SvelteKit vulnerable to Cross-Site Request Forgery","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5p75-vc5g-8rv2","CVE-2023-29003"],"plain_summary":"GitHub lists this reviewed advisory for @sveltejs/kit. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-07e2d7b4829a5ab80ebe7e064beabd49"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-18T14:58:02.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8357fdc943cb56f65924040ee25cd240"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.557%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.46574. Missing scores are unknown.","source_id":"sr-07e2d7b4829a5ab80ebe7e064beabd49"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8357fdc943cb56f65924040ee25cd240","url":"https://github.com/advisories/GHSA-5p75-vc5g-8rv2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5p75-vc5g-8rv2","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"},{"id":"sr-07e2d7b4829a5ab80ebe7e064beabd49","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-29003","publisher":"FIRST EPSS","observed_at":"2026-11-06T00:23:23.954Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8357fdc943cb56f65924040ee25cd240"],"technology":"@sveltejs/kit","known_exclusions":[],"conditions_summary":"### Summary\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at `kit/src/runtime/server/respond.js#L52`. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different `Content-Type` header value.\n\n### Details\nThe CSRF protection is implemented using the code shown below.\n\n```js\nconst forbidden =\n  // (1)\n  request.method === 'POST' &&\n  // (2)\n  request.headers.get('origin') !== url.origin &&\n  // (3)\n  is_form_content_type(request);\n\nif (forbidden) {\n  // (4)\n  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);\n  if (request.headers.get('accept') === 'application/json') {\n    return json(csrf_error.body, { status: csrf_error.status });\n  }\n  return text(csrf_error.body.message, { status: csrf_error.status });\n}\n```\nIf the incoming request specifies a POST method (1), the protection will compare the ser","public_affected_ranges":["< 1.15.1"]}],"null_published_at":"2026-11-08T15:11:49.407Z","source_updated_at":"2026-10-18T14:58:02.000Z","source_disclosed_at":"2023-04-04T21:20:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:14:14.588Z"},{"id":"NVI-00012007","kind":"vulnerability","title":"SvelteKit vulnerable to Cross-Site Request Forgery","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5p75-vc5g-8rv2","CVE-2023-29003"],"plain_summary":"GitHub lists this reviewed advisory for @sveltejs/kit. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-69f7d07c2f945779954c5f2a3e4c58ce"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-18T14:58:02.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8357fdc943cb56f65924040ee25cd240"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.557%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.46448. Missing scores are unknown.","source_id":"sr-69f7d07c2f945779954c5f2a3e4c58ce"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8357fdc943cb56f65924040ee25cd240","url":"https://github.com/advisories/GHSA-5p75-vc5g-8rv2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5p75-vc5g-8rv2","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"},{"id":"sr-69f7d07c2f945779954c5f2a3e4c58ce","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-29003","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:18.435Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8357fdc943cb56f65924040ee25cd240"],"technology":"@sveltejs/kit","known_exclusions":[],"conditions_summary":"### Summary\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at `kit/src/runtime/server/respond.js#L52`. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different `Content-Type` header value.\n\n### Details\nThe CSRF protection is implemented using the code shown below.\n\n```js\nconst forbidden =\n  // (1)\n  request.method === 'POST' &&\n  // (2)\n  request.headers.get('origin') !== url.origin &&\n  // (3)\n  is_form_content_type(request);\n\nif (forbidden) {\n  // (4)\n  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);\n  if (request.headers.get('accept') === 'application/json') {\n    return json(csrf_error.body, { status: csrf_error.status });\n  }\n  return text(csrf_error.body.message, { status: csrf_error.status });\n}\n```\nIf the incoming request specifies a POST method (1), the protection will compare the ser","public_affected_ranges":["< 1.15.1"]}],"null_published_at":"2026-11-01T22:58:19.139Z","source_updated_at":"2026-10-18T14:58:02.000Z","source_disclosed_at":"2023-04-04T21:20:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:14:14.588Z"},{"id":"NVI-00012007","kind":"vulnerability","title":"SvelteKit vulnerable to Cross-Site Request Forgery","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5p75-vc5g-8rv2","CVE-2023-29003"],"plain_summary":"GitHub lists this reviewed advisory for @sveltejs/kit. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-8357fdc943cb56f65924040ee25cd240"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-18T14:58:02.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-8357fdc943cb56f65924040ee25cd240"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8357fdc943cb56f65924040ee25cd240","url":"https://github.com/advisories/GHSA-5p75-vc5g-8rv2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5p75-vc5g-8rv2","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8357fdc943cb56f65924040ee25cd240"],"technology":"@sveltejs/kit","known_exclusions":[],"conditions_summary":"### Summary\nThe SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.\n\nSvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at `kit/src/runtime/server/respond.js#L52`. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different `Content-Type` header value.\n\n### Details\nThe CSRF protection is implemented using the code shown below.\n\n```js\nconst forbidden =\n  // (1)\n  request.method === 'POST' &&\n  // (2)\n  request.headers.get('origin') !== url.origin &&\n  // (3)\n  is_form_content_type(request);\n\nif (forbidden) {\n  // (4)\n  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);\n  if (request.headers.get('accept') === 'application/json') {\n    return json(csrf_error.body, { status: csrf_error.status });\n  }\n  return text(csrf_error.body.message, { status: csrf_error.status });\n}\n```\nIf the incoming request specifies a POST method (1), the protection will compare the ser","public_affected_ranges":["< 1.15.1"]}],"null_published_at":"2026-11-01T01:03:56.621Z","source_updated_at":"2026-10-18T14:58:02.000Z","source_disclosed_at":"2023-04-04T21:20:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:14.588Z"}],"next_cursor":null,"snapshot_revision":"42594"}