svelte is vulnerable to XSS with textarea bind:value

Description

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.59.2
• Patched version(s): 3.59.2

References

• GHSA-gw32-9rmw-qwww
• CWE-79
• OWASP 2021-A3

Related Issues

• Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` - CVE-2026-27901
• DOMPurify is vulnerable to mutation-XSS via Re-Contextualization - Vulnerability
• Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
• Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875

Tags:

npm

svelte