Description
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using
hydratable(an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.
Recommendation
Update the svelte package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.46.0, <= 5.55.6
- Patched version(s): 5.55.7
References
Related Issues
- Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability
- Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization - Vulnerability
- XSS via JQLite DOM manipulation functions in AngularJS - Vulnerability
You might also like:
- Tags:
- npm
- svelte
Anything's wrong? Let us know Last updated on May 14, 2026