SvelteKit, the framework behind Svelte applications, contains a flaw that allows attackers to craft URLs that trigger an open redirect when users submit a form on routes that accept paths starting with a double slash. The vulnerability resides in the enhanced form action handling, where action paths beginning with // are interpreted as protocol-relative URLs. As a result, a request that should stay within the site can redirect a browser to an attacker-controlled domain, exposing users to phishing and credential-stealing attacks. This flaw is identified as CWE-601.

All installations of sveltejs/kit older than version 3.0.0 are affected. The problem appears in any project using enhanced form actions on routes that accept leading double slashes. The specific version range is not narrowed beyond the pre-3.0.0 releases, so any user of the older framework should consider their application vulnerable.

The CVSS score of 2.1 indicates a low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, further implying limited reported exploitation. Nonetheless, because the attack can be performed by simply visiting a crafted link, it is worth patching promptly. The vulnerability is attacker-controlled via URL input and requires no authentication or privileged access. Once patched, no further action is necessary beyond verifying the upgrade.