{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128119", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T22:42:47.031Z", "datePublished": "2026-11-13T19:32:58.899Z", "dateUpdated": "2026-11-13T19:32:58.899Z"}, "containers": {"cna": {"title": "SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-6cf5-gc4q-fm3x"}, {"name": "https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60", "tags": ["x_refsource_MISC"], "url": "https://github.com/sveltejs/kit/commit/2c190febe78a15cac21be539ed9e99dc2d414b60"}, {"name": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@3.1.1"}], "affected": [{"vendor": "sveltejs", "product": "kit", "versions": [{"version": ">= 2.60.1, < 3.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-13T19:32:58.899Z"}, "descriptions": [{"lang": "en", "value": "SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1."}], "source": {"advisory": "GHSA-6cf5-gc4q-fm3x", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}