{"action":"Upgrade @sveltejs/kit to 1.15.1 or later.","affected":[{"fixed":"1.15.1","introduced":"0"}],"component":"@sveltejs/kit","cve_ids":["CVE-2023-29003"],"ecosystem":"npm","epss":0.00557,"exploited":false,"fixed_versions":["1.15.1"],"ghsa_id":"GHSA-5p75-vc5g-8rv2","id":"tcs_01M5KF49DK9ADRA5DXZH2A5CSJ","modified_at":"2026-09-10T03:49:53.416854467Z","published_at":"2023-04-04T21:20:47Z","references":["https://osv.dev/vulnerability/GHSA-5p75-vc5g-8rv2","https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2","https://nvd.nist.gov/vuln/detail/CVE-2023-29003","https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123","https://github.com/sveltejs/kit","https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-5p75-vc5g-8rv2","url":"https://osv.dev/vulnerability/GHSA-5p75-vc5g-8rv2"}],"summary":"SvelteKit vulnerable to Cross-Site Request Forgery"}