Is CVE-2022-25875 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25875 being exploited in the wild.

How severe is CVE-2022-25875?

Low severity, with a CVSS score of 3.1, published 13 July 2022.

Which products and versions are affected?

svelte (npm) SEMVER:introduced=0,fixed=3.49.0.

Is there a fix for CVE-2022-25875?

Yes. svelte (npm): upgrade to 3.49.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25875 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25875?

Check whether you run svelte (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25875: Svelte XSS in server-side rendering via object toString

CVE-2022-25875 · Severity: low · CVSS 3.1 · Published 2022-07-13

Svelte is a popular frontend framework used to build interactive web applications. A vulnerability in its server-side rendering (SSR) feature could allow attackers to inject malicious code that executes in users' browsers if the application renders objects with custom functions. This could lead to theft of user session data, credentials, or malware distribution.

Technologies: svelte (npm). Vendors: npm.

Quick answers

Is CVE-2022-25875 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25875 being exploited in the wild.
How severe is CVE-2022-25875?: Low severity, with a CVSS score of 3.1, published 13 July 2022.
Which products and versions are affected?: svelte (npm) SEMVER:introduced=0,fixed=3.49.0.
Is there a fix for CVE-2022-25875?: Yes. svelte (npm): upgrade to 3.49.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25875 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25875?: Check whether you run svelte (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

svelte (npm): upgrade to 3.49.0 or later
```
npm install svelte@3.49.0
```

Technical details

Svelte before version 3.49.0 is vulnerable to cross-site scripting (XSS) due to improper input sanitization and inadequate escaping of object attributes during server-side rendering. The vulnerability exists in the attribute escaping logic and can be exploited by passing objects with a custom toString() function that returns malicious HTML/JavaScript. An attacker must control the objects passed to the Svelte component during SSR, typically through user-supplied input. When the framework calls toString() on these objects during HTML generation, the malicious payload is rendered unescaped into the HTML document. The fix, merged in pull request #7530, hardens attribute escaping during SSR and was released in version 3.49.0.

Affected products

Svelte Svelte before 3.49.0

Identifiers

CVE-2022-25875
GHSA-wv8q-r932-8hc7

Timeline

2022-07-13: disclosed
2022-06-20: patched: Fix merged in PR #7530

References

https://github.com/sveltejs/svelte/pull/7530

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.