GHSA-hgv7-v322-mmgr: add CVSS v3.1 score and fix commit reference

[anandmt]

Reason for change

This advisory for the @sveltejs/kit query.batch cross-talk vulnerability (cross-user data disclosure) includes a CVSS v4.0 score but is missing a CVSS v3.1 score, which many downstream vulnerability scanners and compliance tools still require. It is also missing a reference to the fix commit.

Changes

• Added CVSS v3.1 score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N (5.9 — Medium). Rationale: Network-accessible (AV:N), but requires rare timing conditions for exploitation (AC:H), low-privileged attacker (PR:L), and some user interaction (UI:R). High confidentiality impact due to cross-user data disclosure (C:H), low integrity impact (I:L), no availability impact (A:N).
• Added fix commit reference: sveltejs/kit@dadaefc2e647 — "fix: prevent query.batch cross-talk", merged May 14, 2026.

Supporting evidence

• SvelteKit security advisory: GHSA-hgv7-v322-mmgr
• Fix commit: sveltejs/kit@dadaefc
• CVEReports analysis with CVSS v3.1 vector: https://cvereports.com/reports/GHSA-HGV7-V322-MMGR

[advisory-database]

Hi @anandmt! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!