svelte is vulnerable to XSS with textarea bind:value

Description

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.59.2
• Patched version(s): 3.59.2

References

• GHSA-gw32-9rmw-qwww
• CWE-79
• OWASP 2021-A3

Related Issues

• svelte vulnerable to Cross-site Scripting - CVE-2025-15265
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-4xc9-xhrj-v574) - CVE-2018-16487
• jquery-validation vulnerable to Cross-site Scripting - CVE-2025-3573

Tags:

npm

svelte