@sveltejs/kit

SvelteKit is the fastest way to build Svelte apps

Latest 3.0.1

94%

Total Score

healthy

Frequent releases, active contributors, provenance, and an archived-free repository outweigh a limited workflow secret-exposure concern.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The repository uses TypeScript, Vitest, Vite, and npm scripts, and the collected signal reports no security-scanning tools. The established build and test tooling supports maintainability, while the missing scanner is a minor hygiene gap.

Workflow audit

All 6 workflows were analyzed successfully; all use read-only permissions and all 28 action references are pinned. Two high-confidence medium-severity secrets-inherit findings expose inherited secrets in a reusable workflow, creating a limited workflow hygiene concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-106555 @sveltejs/kit is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 2.70.1.	0.0.1 - 2.70.1	Medium
AIKIDO-2026-53446 @sveltejs/kit is vulnerable to Denial of Service in versions 2.49.0 - 2.69.0.	2.49.0 - 2.69.0	Medium
AIKIDO-2026-933319 @sveltejs/kit is vulnerable to Prototype Pollution in versions 2.44.0 - 2.69.0.	2.44.0 - 2.69.0	Medium
AIKIDO-2026-401792 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @sveltejs/kit is vulnerable to Cross-Site Request Forgery (CSRF) in versions 2.36.3 - 2.69.3.	2.36.3 - 2.69.3	Medium
AIKIDO-2026-865660 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @sveltejs/kit is vulnerable to Sensitive Information Disclosure in versions 2.27.0 - 2.65.1.	2.27.0 - 2.65.1	Medium