CVE-2026-128119
Received Received - Intake

Remote Function Argument Disclosure in SvelteKit

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128119
EUVD
EUVD-2026-125731

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SvelteKit versions 2.60.1 to 3.1.0 have a flaw where experimental remote functions could assign the same identifier to separate non-exported query.batch functions. This causes arguments meant for one function to be passed to another when they share a request batch, leading to unexpected processing and potential disclosure of function arguments.

Impact Analysis

If you use SvelteKit with the experimental remote functions flag enabled, an attacker could intercept or manipulate function arguments, leading to unintended data exposure or processing. This could affect data integrity or confidentiality in your application.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance violations if sensitive data is exposed due to this issue.

Mitigation Strategies

Upgrade SvelteKit to version 3.1.1 or later to address the issue with experimental remote functions and identifier conflicts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...