Rich Harris

3 exploits Active since Jan 2024
CVE-2024-23641 WRITEUP HIGH WRITEUP
SvelteKit 2.0.0-2.4.2 - Denial of Service via GET Request with Body
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
CVSS 7.5
CVE-2025-32388 WRITEUP MEDIUM WRITEUP
SvelteKit 2.0.0-2.20.5 - Cross-Site Scripting via Unsanitized Search Param Names
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.
CVSS 5.4
CVE-2025-57820 WRITEUP HIGH WRITEUP
devalue < 5.3.2 - Prototype Pollution via __proto__ Property Parsing
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2