SvelteKit versions earlier than 3.0.0 are vulnerable to a cross‑site scripting flaw caused by unescaped insertion of a cache‑control header value into a <meta http-equiv="cache-control"> tag on prerendered pages. The flaw allows an attacker who can influence that header at prerender time to break out of the content attribute and inject arbitrary HTML or JavaScript that executes when a user subsequently visits the page.

The affected product is SvelteKit from the sveltejs organization. Only releases prior to 3.0.0 are impacted; no specific sub‑versions are listed.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. The attack requires the ability to influence a prerendered page to set the untrusted cache‑control header value, after which the flaw can be abused to force execution of malicious code by any user who opens the affected page.