CVE-2026-27118

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27118", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T18:42:27.043Z", "datePublished": "2026-02-20T21:24:55.577Z", "dateUpdated": "2026-02-24T18:42:11.028Z"}, "containers": {"cna": {"title": "Cache poisoning in @sveltejs/adapter-vercel", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c"}], "affected": [{"vendor": "sveltejs", "product": "kit", "versions": [{"version": "< 6.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:24:55.577Z"}, "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2."}], "source": {"advisory": "GHSA-9pq4-5hcf-288c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:41:44.555338Z", "id": "CVE-2026-27118", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:42:11.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27118", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:41:44.555338Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:42:01.436Z"}}], "cna": {"title": "Cache poisoning in @sveltejs/adapter-vercel", "source": {"advisory": "GHSA-9pq4-5hcf-288c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "sveltejs", "product": "kit", "versions": [{"status": "affected", "version": "< 6.3.2"}]}], "references": [{"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c", "name": "https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:24:55.577Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27118", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:42:11.028Z", "dateReserved": "2026-02-17T18:42:27.043Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T21:24:55.577Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kit", "vendor": "sveltejs", "versions": [{"status": "affected", "version": "< 6.3.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2."}, {"lang": "es", "value": "SvelteKit es un framework para desarrollar r\u00e1pidamente aplicaciones web robustas y de alto rendimiento utilizando Svelte. Las versiones de @sveltejs/adapter-vercel anteriores a la 6.3.2 son vulnerables al envenenamiento de cach\u00e9. Un par\u00e1metro de consulta interno destinado a la Regeneraci\u00f3n Est\u00e1tica Incremental (ISR) es accesible en todas las rutas, permitiendo a un atacante causar que respuestas sensibles y espec\u00edficas del usuario sean almacenadas en cach\u00e9 y servidas a otros usuarios. La explotaci\u00f3n exitosa requiere que una v\u00edctima visite un enlace controlado por el atacante mientras est\u00e1 autenticada. Las implementaciones existentes est\u00e1n protegidas por el WAF de Vercel, pero los usuarios deben actualizar lo antes posible. Esta vulnerabilidad est\u00e1 corregida en la 6.3.2."}], "id": "CVE-2026-27118", "lastModified": "2026-06-17T10:26:41.960", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27118", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:41:44.555338Z", "version": "2.0.3"}}]}, "published": "2026-02-20T22:16:29.673", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-9pq4-5hcf-288c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.3.2)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "kit", "source": "cna", "vendor": "sveltejs"}, "product": "kit", "vendor": "svelte"}], "analysis": {"en": {"generated_at": "2026-04-18T11:26:14.998065+00:00", "value": {"mitigation_remediation": ["Upgrade the @sveltejs/adapter-vercel package to version 6.3.2 or later. ", "If an immediate upgrade is not possible, add application middleware that rejects or ignores requests containing the internal ISR query parameter to prevent cache poisoning. ", "Ensure that the deployment environment has Vercel's WAF enabled or implement an equivalent WAF rule to block request paths that use the internal query parameter."], "summary": {"action": "Patch Now", "impact": "Sensitive data exposure"}, "threat_synthesis": {"affected_systems": "The flaw affects applications built with SvelteKit that use the @sveltejs/adapter-vercel package older than version 6.3.2. Any deployment of such an app on Vercel, or similar hosting environments where the internal query parameter is exposed, is at risk until the upgrade to the fixed version is applied.", "description_and_impact": "The vulnerability is a cache poisoning flaw in the SvelteKit Vercel adapter with versions prior to 6.3.2. An internal query parameter used by Incremental Static Regeneration can be accessed on any route, allowing an attacker to instruct the system to cache responses that contain user\u2011specific content. When a victim who is authenticated follows a malicious link, the crafted request can cause the private response to be cached and subsequently served to other users, leading to a confidentiality breach. This flaw is classified as CWE\u2011346, reflecting a broken object\u2011level authorization that permits unauthorized access to sensitive data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1\u202f%, meaning the probability of exploitation is low but not negligible. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the victim to be authenticated and to click on a specially crafted link that includes the internal query parameter. Host\u2011level protection such as Vercel's WAF can block the request, so existing deployments are currently shielded by that mechanism, but the issue remains unresolved if the app can be accessed without that WAF protection."}}}}, "created": "2026-02-23T14:35:02.239331+00:00", "updated": "2026-04-18T11:30:44.323013+00:00", "vendors": ["svelte", "svelte$PRODUCT$kit"]}