GitHub's advisory database published a notice on 13 November 2026 about @sveltejs/adapter-cloudflare, the tool that packages SvelteKit sites for Cloudflare. It says paths used for prerendered redirects can let an outsider add their own rules to the _redirects file. Prerendering means building pages ahead of time, before visitors arrive. The condition is that someone can influence which links the prerender step crawls. If so, they can influence the redirect entries the adapter adds in its adapt step. The notice links to adapter releases 7.2.10 and 8.0.2.
The advisory page loaded with an error, so only part of it was visible. Severity, a CVE number and the affected versions did not appear, but the full advisory may list them. The visible text also does not say how someone could influence the crawled links. It does not say which rules could be added. Check the full advisory on GitHub for those details.
A prerender step follows links to find pages, and the adapter turns some of those paths into redirect entries. In plain terms, what the build crawls can become live deployment settings. Teams can ask who controls the content and links the build crawls, and who reviews generated config. The advisory links releases in both the 7.x and 8.x lines, so teams can compare their version with the one in their line.