{"id":"EUVD-2026-67584","enisaUuid":"89055cd5-d4c9-389d-8112-409a3f379242","description":"SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users\u0027 concurrent requests.","datePublished":"Aug 28, 2026, 10:49:42 AM","dateUpdated":"Oct 8, 2026, 3:25:30 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr\nhttps://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch\n","aliases":"CVE-2026-82258\nGHSA-m99x-q38g-c4c6\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"3358e606-d4dd-3056-b2dc-2be8ff2bb44b","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"2.38.0 \u003c2.60.1"}],"enisaIdVendor":[{"id":"e2e37822-b47b-33b2-b78a-833e94862490","vendor":{"name":"sveltejs"}}],"enisaIdVulnerability":[{"id":"2357ec4c-8258-3395-a202-a878f5bf2540","vulnerability":{"id":"GHSA-m99x-q38g-c4c6","description":"SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users\u0027 concurrent requests.","datePublished":"Aug 28, 2026, 12:30:29 PM","dateUpdated":"Aug 31, 2026, 6:31:23 PM","baseScore":0.0,"references":"https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82258\nhttps://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch\n","enisa_id":"EUVD-2026-67584\n","aliases":"CVE-2026-82258\nGHSA-m99x-q38g-c4c6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eb12809d-66d8-33bf-ba89-6f9af0a721fe","vulnerability":{"id":"CVE-2026-82258","description":"SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users\u0027 concurrent requests.","datePublished":"Aug 28, 2026, 10:49:42 AM","dateUpdated":"Oct 8, 2026, 3:25:30 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr\nhttps://www.vulncheck.com/advisories/sveltekit-2.38.0-before-2.60.1-cross-user-data-disclosure-via-query-batch\n","enisa_id":"EUVD-2026-67584\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Nov 5, 2026, 7:20:48 AM","vulnerabilityProduct":[{"id":"8534ef00-d448-317b-890a-d4328a068508","product":{"name":"kit","vendor":{"name":"sveltejs"}},"product_version":"2.38.0 \u003c2.60.1"}],"vulnerabilityVendor":[{"id":"dcd0c6fd-f623-3640-a060-6c077be68410","vendor":{"name":"sveltejs"}}]}}],"enisaIdAdvisory":[]}