All vulnerabilities
GHSA-xgrj-p7pg-6vm3

@sveltejs/kit: `vite preview` path traversal vulnerability on Windows

@sveltejs/kit
Open in ThreatlineRecord JSON
CVSS
n/aMedium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.0.0Fixed versionGitHub
Published5 Oct 2026Updated 5 Oct 2026GitHub

What fixes it

  • 3.0.0@sveltejs/kit, npmGitHubnpm install @sveltejs/kit@3.0.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

SvelteKit’s preview server (vite preview) has a path traversal vulnerability on Windows. An unauthenticated attacker who can reach the preview server can send a specially crafted request to read files outside the prerendered output directory. This could expose sensitive files readable by the server process, such as application source code, configuration, or credentials. The vulnerability was introduced in @sveltejs/kit 2.10.0. It affects preview servers running on Windows, particularly when exposed to untrusted clients through network access or a tunnel. The development server, production adapters, and preview servers running on other operating systems are not affected.

Patches

The issue is fixed in @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.

Workarounds

Until upgrading, prevent untrusted clients from accessing the preview server. Keep it bound to localhost (avoid using the --host flag or preview.host configuration, especially on untrusted networks), remove public tunnels, and restrict network access as appropriate.

Running the preview server on a non-Windows operating system also avoids this vulnerability.

Text from GitHub Advisory Database

Affected versions 1

  • @sveltejs/kit, npm>= 2.10.0GitHub