Svelecte item names vulnerable to execution of arbitrary JavaScript

Description

Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened.

Recommendation

Update the svelecte package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.16.3
• Patched version(s): 3.16.3

References

• GHSA-7h45-grc5-89wq
• CVE-2023-38687
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

svelecte