Svelte SSR attribute spreading includes inherited properties from prototype chain

Description

In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object’s prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte’s control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.51.4
• Patched version(s): 5.51.5

References

• GHSA-crpf-4hrx-3jrp
• CVE-2026-27125
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8