GHSA-hgv7-v322-mmgr: add CVSS v3.1 score and fix commit reference

Author: anandmt

advisories/github-reviewed/2026/05/GHSA-hgv7-v322-mmgr/GHSA-hgv7-v322-mmgr.json

@@ -1,58 +1,63 @@
 {
-  "schema_version": "1.4.0",
-  "id": "GHSA-hgv7-v322-mmgr",
-  "modified": "2026-05-21T17:59:05Z",
-  "published": "2026-05-21T17:59:05Z",
-  "aliases": [],
-  "summary": "@sveltejs/kit: `query.batch` cross-talk",
-  "details": "`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.",
-  "severity": [
-    {
-      "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
-    }
-  ],
-  "affected": [
-    {
-      "package": {
-        "ecosystem": "npm",
-        "name": "@sveltejs/kit"
-      },
-      "ranges": [
+    "schema_version": "1.4.0",
+    "id": "GHSA-hgv7-v322-mmgr",
+    "modified": "2026-05-21T17:59:05Z",
+    "published": "2026-05-21T17:59:05Z",
+    "aliases": [],
+    "summary": "@sveltejs/kit: `query.batch` cross-talk",
+    "details": "`query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.",
+    "severity": [
+        {
+            "type": "CVSS_V4",
+            "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
+        },
         {
-          "type": "ECOSYSTEM",
-          "events": [
-            {
-              "introduced": "2.38.0"
+            "type": "CVSS_V3",
+            "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N"
+        }
+    ],
+    "affected": [
+        {
+            "package": {
+                "ecosystem": "npm",
+                "name": "@sveltejs/kit"
             },
-            {
-              "fixed": "2.60.1"
-            }
-          ]
+            "ranges": [
+                {
+                    "type": "ECOSYSTEM",
+                    "events": [
+                        {
+                            "introduced": "2.38.0"
+                        },
+                        {
+                            "fixed": "2.60.1"
+                        }
+                    ]
+                }
+            ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "<= 2.60.0"
-      }
-    }
-  ],
-  "references": [
-    {
-      "type": "WEB",
-      "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr"
-    },
-    {
-      "type": "PACKAGE",
-      "url": "https://github.com/sveltejs/kit"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-200"
     ],
-    "severity": "MODERATE",
-    "github_reviewed": true,
-    "github_reviewed_at": "2026-05-21T17:59:05Z",
-    "nvd_published_at": null
-  }
-}
+    "references": [
+        {
+            "type": "WEB",
+            "url": "https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr"
+        },
+        {
+            "type": "WEB",
+            "url": "https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056"
+        },
+        {
+            "type": "PACKAGE",
+            "url": "https://github.com/sveltejs/kit"
+        }
+    ],
+    "database_specific": {
+        "cwe_ids": [
+            "CWE-200"
+        ],
+        "severity": "MODERATE",
+        "github_reviewed": true,
+        "github_reviewed_at": "2026-05-21T17:59:05Z",
+        "nvd_published_at": null
+    }
+}