{"schema":"threatline.record/2","record":{"id":"GHSA-xgrj-p7pg-6vm3","aliases":["GHSA-xgrj-p7pg-6vm3"],"summary":"`vite preview` path traversal vulnerability on Windows","details":"### Impact\r\n\r\nSvelteKit’s preview server (`vite preview`) has a path traversal vulnerability on Windows. An unauthenticated attacker who can reach the preview server can send a specially crafted request to read files outside the prerendered output directory. This could expose sensitive files readable by the server process, such as application source code, configuration, or credentials.\r\nThe vulnerability was introduced in `@sveltejs/kit 2.10.0`. It affects preview servers running on Windows, particularly when exposed to untrusted clients through network access or a tunnel. The development server, production adapters, and preview servers running on other operating systems are not affected.\r\n\r\n### Patches\r\n\r\nThe issue is fixed in `@sveltejs/kit` 3.0.0. Users should upgrade to 3.0.0 or later.\r\n\r\n### Workarounds\r\n\r\nUntil upgrading, prevent untrusted clients from accessing the preview server. Keep it bound to localhost (avoid using the `--host` flag or `preview.host` configuration, especially on untrusted networks), remove public tunnels, and restrict network access as appropriate.\r\n\r\nRunning the preview server on a non-Windows operating system also avoids this vulnerability.","categories":["Unclassified"],"product":"@sveltejs/kit","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3","source_modified_at":"2026-10-05T19:34:24Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"npm","name":"@sveltejs/kit"},"range":">= 2.10.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3","source_modified_at":"2026-10-05T19:34:24Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"npm","name":"@sveltejs/kit"},"version":"3.0.0"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T19:33:38Z","modified_at":"2026-10-05T19:34:24Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-05T19:34:24Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T19:34:24Z","content_hash":"0df4f79e2b0fd9126862c9e3ff01107046d69315ab1742c1700e03bccfc2d5ac"}}