Executive brief
Svelte, a popular JavaScript framework for building web applications, has a cross-site scripting (XSS) vulnerability in its server-side rendering feature. The vulnerability allows an attacker to inject malicious JavaScript that executes in users' browsers by exploiting improper HTML escaping in certain contexts, such as within noscript tags. This can lead to session hijacking, credential theft, or malware distribution to affected users.
Technical details
Svelte improperly escapes HTML during server-side rendering. The framework applies different escaping rules for attribute values (escaping quotes and ampersands) versus other contexts (escaping angle brackets and ampersands), with an assumption that attributes remain as attribute values. However, when malicious content is injected into an attribute within a noscript tag, the browser's DOM parsing can diverge from the server-side rendering expectations, allowing the injected payload to break out of the attribute context and execute as JavaScript. The attack requires user interaction (clicking a malicious link) and network access. Versions prior to 4.2.19 are affected; patches are available in 4.2.19 and version 5 and later.
Affected products
- Svelte Svelte < 4.2.19
Timeline
- 2024-08-30: disclosed
- 2024-08-30: patched: Version 4.2.19 and version 5 and later