{"id":"GHSA-hgv7-v322-mmgr","revision":"0686c8e85b2c4d61b70f5eebdbcd5a7c","records":[{"revision":"0686c8e85b2c4d61b70f5eebdbcd5a7c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-hgv7-v322-mmgr","aliases":["CVE-2026-82258"],"title":"@sveltejs/kit: `query.batch` cross-talk","description":"`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.","state":0,"publishedAt":"2026-05-21T17:59:05+00:00","modifiedAt":"2026-09-10T03:50:47.0975746+00:00","affected":[{"ecosystem":"npm","name":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.38.0"},{"kind":"fixed","version":"2.60.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr","https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056","https://github.com/sveltejs/kit"],"sourceUrl":"https://github.com/advisories/GHSA-hgv7-v322-mmgr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hgv7-v322-mmgr","identifiers":["GHSA-hgv7-v322-mmgr","CVE-2026-82258"]},"retained":false,"historicalAffected":[]}],"coverage":[]}