Svelte SSR vulnerable to cross-site scripting via spread attributes

Description

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims’ browsers.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-pr6f-5x2q-rwfp
• CVE-2026-42599
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters - CVE-2023-26491

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

svelte