CVE-2026-128119
SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations
Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.
INFO
Published Date :
Nov. 13, 2026, 7:32 p.m.
Last Modified :
Nov. 13, 2026, 7:32 p.m.
Remotely Exploit :
Yes !
Source :
GitHub_M
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update SvelteKit to version 3.1.1 or later.
- Disable experimental remote functions if unable to update.
- Review function usage for potential data leakage.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-128119 vulnerability anywhere in the article.