sveltejs/kit · Security
@sveltejs/kit: `query.batch` cross-talk
- GHSA ID
- GHSA-hgv7-v322-mmgr
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.9 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Description
query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor