Impact
SvelteKit’s preview server (vite preview) has a path traversal vulnerability on Windows. An unauthenticated attacker who can reach the preview server can send a specially crafted request to read files outside the prerendered output directory. This could expose sensitive files readable by the server process, such as application source code, configuration, or credentials.
The vulnerability was introduced in @sveltejs/kit 2.10.0. It affects preview servers running on Windows, particularly when exposed to untrusted clients through network access or a tunnel. The development server, production adapters, and preview servers running on other operating systems are not affected.
Patches
The issue is fixed in @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.
Workarounds
Until upgrading, prevent untrusted clients from accessing the preview server. Keep it bound to localhost (avoid using the --host flag or preview.host configuration, especially on untrusted networks), remove public tunnels, and restrict network access as appropriate.
Running the preview server on a non-Windows operating system also avoids this vulnerability.
GekkoQuest Reporter
Rich-Harris Remediation developer
Impact
SvelteKit’s preview server (
vite preview) has a path traversal vulnerability on Windows. An unauthenticated attacker who can reach the preview server can send a specially crafted request to read files outside the prerendered output directory. This could expose sensitive files readable by the server process, such as application source code, configuration, or credentials.The vulnerability was introduced in
@sveltejs/kit 2.10.0. It affects preview servers running on Windows, particularly when exposed to untrusted clients through network access or a tunnel. The development server, production adapters, and preview servers running on other operating systems are not affected.Patches
The issue is fixed in
@sveltejs/kit3.0.0. Users should upgrade to 3.0.0 or later.Workarounds
Until upgrading, prevent untrusted clients from accessing the preview server. Keep it bound to localhost (avoid using the
--hostflag orpreview.hostconfiguration, especially on untrusted networks), remove public tunnels, and restrict network access as appropriate.Running the preview server on a non-Windows operating system also avoids this vulnerability.