chore(deps): update dependency @sveltejs/kit to v2.8.3 [security]

[auvo-renovate]

This PR contains the following updates:

Package	Type	Update	Change
@sveltejs/kit (source)	devDependencies	minor	2.7.4 -> 2.8.3

---

@​sveltejs/kit has unescaped error message included on error page

CVE-2024-53262 / GHSA-mh2x-fcqh-fmqv

More information

Details

Summary

The static error.html template for errors contains placeholders that are replaced without escaping the content first.

Details

From https://kit.svelte.dev/docs/errors:

error.html is the page that is rendered when everything else fails. It can contain the following placeholders:
%sveltekit.status% — the HTTP status
%sveltekit.error.message% — the error message

This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content that ends up being something like this inside a server handle function:

error(500, '<script>alert("boom")</script>');

Uncaught errors cannot be exploited like this, as they always render the message "Internal error".

Escaping the message string in the function that creates the html output can be done to improve safety for applications that are using custom errors on the server.

PoC

None provided

Impact

Only applications where user provided input is used in the Error message will be vulnerable, so the vast majority of applications will not be vulnerable

Severity

• CVSS Score: 4.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-mh2x-fcqh-fmqv
• https://nvd.nist.gov/vuln/detail/CVE-2024-53262
• https://github.com/sveltejs/kit/pull/13050
• https://github.com/sveltejs/kit/commit/134e36343ef57ed7e6e2b3bb9e7f05ad37865794
• https://github.com/sveltejs/kit
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.8.3
• https://kit.svelte.dev/docs/errors

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

@​sveltejs/kit vulnerable to XSS on dev mode 404 page

CVE-2024-53261 / GHSA-rjjv-87mx-6x3h

More information

Details

Summary

"Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)."

Details

Source of potentially tainted data is in packages/kit/src/exports/vite/dev/index.js, line 437. This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down to line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

Another source of potentially tainted data (according to Snyk) comes from ‎packages/kit/src/exports/vite/utils.js, line 30, col 30 (i.e., the url property of req). This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

PoC

Not provided

Impact

Little to none. The Vite development is not exposed to the network by default. And even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data.

Severity

• CVSS Score: 0.0 / 10 (None)
• Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-rjjv-87mx-6x3h
• https://nvd.nist.gov/vuln/detail/CVE-2024-53261
• https://github.com/sveltejs/kit/pull/13039
• https://github.com/sveltejs/kit/commit/d338d4635a7fd947ba5112df6ee632c4a0979438
• https://github.com/sveltejs/kit
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.8.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.8.3

Compare Source

Patch Changes

• fix: ensure error messages are escaped (#​13050)

• fix: escape values included in dev 404 page (#​13039)

v2.8.2

Compare Source

Patch Changes

• fix: prevent duplicate fetch request when using Request with load function's fetch (#​13023)

• fix: do not override default cookie decoder to allow users to override the cookie library version (#​13037)

v2.8.1

Compare Source

Patch Changes

• fix: only add nonce to script-src-elem, style-src-attr and style-src-elem CSP directives when unsafe-inline is not present (#​11613)

• fix: support HTTP/2 in dev and production. Revert the changes from #​12907 to downgrade HTTP/2 to TLS as now being unnecessary (#​12989)

v2.8.0

Compare Source

Minor Changes

• feat: add helper to identify ActionFailure objects (#​12878)

v2.7.7

Compare Source

Patch Changes

• fix: update link in JSDoc (#​12963)

v2.7.6

Compare Source

Patch Changes

• fix: update broken links in JSDoc (#​12960)

v2.7.5

Compare Source

Patch Changes

• fix: warn on invalid cookie name characters (#​12806)

• fix: when using @vitejs/plugin-basic-ssl, set a no-op proxy config to downgrade from HTTP/2 to TLS since undici does not yet enable HTTP/2 by default (#​12907)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.