Svelte SSR vulnerable to cross-site scripting via spread attributes

Description

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims’ browsers.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-pr6f-5x2q-rwfp
• CVE-2026-42599
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6