CVE-2023-29008

CVE-2023-29008 is a Cross-Site Request Forgery (CSRF) bypass vulnerability affecting SvelteKit versions prior to 1.15.2. It allows attackers to bypass SvelteKit's built-in CSRF protection by using an upper-cased Content-Type header, enabling malicious requests from third-party domains. This vulnerability has a CVSS score of 8.8 (High), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the vulnerability could lead to unauthorized account access under specific SameSite cookie configurations and browser conditions.