Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

Description

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

Recommendation

Update the svelte package to the latest compatible version. Followings are version details:

Affected version(s): <= 5.55.6
Patched version(s): 5.55.7

References

GHSA-rcqx-6q8c-2c42
CVE-2026-42573
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State and gives you actionable findings to investigate.

Start a free scan

Related Issues

wetty vulnerable to DOM XSS via file-download filename - CVE-2026-49864
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated June 09, 2026