Svelte SSR vulnerable to cross-site scripting via spread attributes

Description

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims’ browsers.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-pr6f-5x2q-rwfp
• CVE-2026-42599
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

svelte