svelte is vulnerable to XSS with textarea bind:value

Description

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.59.2
• Patched version(s): 3.59.2

References

• GHSA-gw32-9rmw-qwww
• CWE-79
• OWASP 2021-A3

Related Issues

• Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` - CVE-2026-27901
• Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability
• Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
• Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

svelte