CVE-2026-82258 MEDIUM

CVE-2026-82258: SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

Vendor Sveltejs

Product kit

Weakness CWE-362

Published August 28, 2026

Last update August 28, 2026

View on NVD All CVEs

CVSS base score

5.9/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.

Key dates

02Disclosure timeline

August 28, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-82258 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/362.html AskarLabs — CWE-362 write-up Race Condition

Related vulnerabilities

04Related CVE

CVE-2025-47545 WordPress Poll Maker plugin <= 5.7.7 - Race Condition Vulnerability CVE-2025-59577 WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability CVE-2025-13231 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition CVE-2023-6109 YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation CVE-2022-0279 AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition