Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Description

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

• you are using hydratable (an experimental feature at the time of this report)
• you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.46.0, <= 5.55.6
• Patched version(s): 5.55.7

References

• GHSA-f3cj-j4f6-wq85
• CWE-79
• OWASP 2021-A3