diff --git a/advisories/github-reviewed/2026/05/GHSA-hgv7-v322-mmgr/GHSA-hgv7-v322-mmgr.json b/advisories/github-reviewed/2026/05/GHSA-hgv7-v322-mmgr/GHSA-hgv7-v322-mmgr.json index a9c969b99fc97..0be8ac408a33a 100644 --- a/advisories/github-reviewed/2026/05/GHSA-hgv7-v322-mmgr/GHSA-hgv7-v322-mmgr.json +++ b/advisories/github-reviewed/2026/05/GHSA-hgv7-v322-mmgr/GHSA-hgv7-v322-mmgr.json @@ -1,58 +1,63 @@ { - "schema_version": "1.4.0", - "id": "GHSA-hgv7-v322-mmgr", - "modified": "2026-05-21T17:59:05Z", - "published": "2026-05-21T17:59:05Z", - "aliases": [], - "summary": "@sveltejs/kit: `query.batch` cross-talk", - "details": "`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" - } - ], - "affected": [ - { - "package": { - "ecosystem": "npm", - "name": "@sveltejs/kit" - }, - "ranges": [ + "schema_version": "1.4.0", + "id": "GHSA-hgv7-v322-mmgr", + "modified": "2026-05-21T17:59:05Z", + "published": "2026-05-21T17:59:05Z", + "aliases": [], + "summary": "@sveltejs/kit: `query.batch` cross-talk", + "details": "`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" + }, { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.38.0" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@sveltejs/kit" }, - { - "fixed": "2.60.1" - } - ] + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.38.0" + }, + { + "fixed": "2.60.1" + } + ] + } + ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.60.0" - } - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr" - }, - { - "type": "PACKAGE", - "url": "https://github.com/sveltejs/kit" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" ], - "severity": "MODERATE", - "github_reviewed": true, - "github_reviewed_at": "2026-05-21T17:59:05Z", - "nvd_published_at": null - } -} \ No newline at end of file + "references": [ + { + "type": "WEB", + "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr" + }, + { + "type": "WEB", + "url": "https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sveltejs/kit" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-05-21T17:59:05Z", + "nvd_published_at": null + } +}