GHSA-5wg4-q3ww-283h: SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

• Severity: MEDIUM
• CVE: CVE-2026-128122
• Ecosystems: npm, npm
• Packages: @sveltejs/adapter-cloudflare, @sveltejs/adapter-cloudflare

If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.

Source: GitHub Security Advisories · 2026-11-13