# CVE-2022-25875: Svelte XSS in server-side rendering via object toString

Source: https://junglewise.ai/threats/cve-2022-25875-svelte-xss-in-server-side-rendering-via-object-tostring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25875 · Severity: low · CVSS 3.1 · Published 2022-07-13

Svelte is a popular frontend framework used to build interactive web applications. A vulnerability in its server-side rendering (SSR) feature could allow attackers to inject malicious code that executes in users' browsers if the application renders objects with custom functions. This could lead to theft of user session data, credentials, or malware distribution.

Technologies: [svelte (npm)](https://junglewise.ai/threats/technologies/svelte). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25875 being exploited in the wild.

**How severe is CVE-2022-25875?** Low severity, with a CVSS score of 3.1, published 13 July 2022.

**Which products and versions are affected?** svelte (npm) SEMVER:introduced=0,fixed=3.49.0.

**Is there a fix for CVE-2022-25875?** Yes. svelte (npm): upgrade to 3.49.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25875 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25875?** Check whether you run svelte (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- svelte (npm): upgrade to 3.49.0 or later

  ```sh
  npm install svelte@3.49.0
  ```


## Technical details

Svelte before version 3.49.0 is vulnerable to cross-site scripting (XSS) due to improper input sanitization and inadequate escaping of object attributes during server-side rendering. The vulnerability exists in the attribute escaping logic and can be exploited by passing objects with a custom toString() function that returns malicious HTML/JavaScript. An attacker must control the objects passed to the Svelte component during SSR, typically through user-supplied input. When the framework calls toString() on these objects during HTML generation, the malicious payload is rendered unescaped into the HTML document. The fix, merged in pull request #7530, hardens attribute escaping during SSR and was released in version 3.49.0.

## Affected products

- Svelte Svelte before 3.49.0

## Identifiers

- CVE-2022-25875
- GHSA-wv8q-r932-8hc7

## Timeline

- 2022-07-13: disclosed
- 2022-06-20: patched: Fix merged in PR #7530

## References

- [https://github.com/sveltejs/svelte/pull/7530](https://github.com/sveltejs/svelte/pull/7530)

## Related threats

- [Svelte XSS via spread attributes in SSR](https://junglewise.ai/threats/cve-2026-42599-svelte-xss-via-spread-attributes-in-ssr)
- [Svelte DOM clobbering leading to XSS in internal framework state](https://junglewise.ai/threats/cve-2026-42573-svelte-dom-clobbering-leading-to-xss-in-internal-framework-state)
- [Svelte ReDoS in svelte:element tag validation](https://junglewise.ai/threats/cve-2026-42567-svelte-redos-in-svelte-element-tag-validation)
- [Svelte XSS via insecure promise serialization in hydratable](https://junglewise.ai/threats/svelte-xss-via-insecure-promise-serialization-in-hydratable-3f504409)
- [Svelte XSS via HTML comment injection in SSR error boundary](https://junglewise.ai/threats/cve-2026-27902-svelte-xss-via-html-comment-injection-in-ssr-error-boundary)