# CVE-2024-45047: Svelte improper HTML escaping in server-side rendering

Source: https://junglewise.ai/threats/cve-2024-45047-svelte-improper-html-escaping-in-server-side-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-45047 · Severity: low · CVSS 3.1 · Published 2024-08-30

Svelte, a popular JavaScript framework for building web applications, has a cross-site scripting (XSS) vulnerability in its server-side rendering feature. The vulnerability allows an attacker to inject malicious JavaScript that executes in users' browsers by exploiting improper HTML escaping in certain contexts, such as within noscript tags. This can lead to session hijacking, credential theft, or malware distribution to affected users.

Technologies: [svelte (npm)](https://junglewise.ai/threats/technologies/svelte). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-45047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-45047 being exploited in the wild.

**How severe is CVE-2024-45047?** Low severity, with a CVSS score of 3.1, published 30 August 2024.

**Which products and versions are affected?** svelte (npm) SEMVER:introduced=0,fixed=4.2.19.

**Is there a fix for CVE-2024-45047?** Yes. svelte (npm): upgrade to 4.2.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-45047 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-45047?** Check whether you run svelte (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- svelte (npm): upgrade to 4.2.19 or later

  ```sh
  npm install svelte@4.2.19
  ```


## Technical details

Svelte improperly escapes HTML during server-side rendering. The framework applies different escaping rules for attribute values (escaping quotes and ampersands) versus other contexts (escaping angle brackets and ampersands), with an assumption that attributes remain as attribute values. However, when malicious content is injected into an attribute within a noscript tag, the browser's DOM parsing can diverge from the server-side rendering expectations, allowing the injected payload to break out of the attribute context and execute as JavaScript. The attack requires user interaction (clicking a malicious link) and network access. Versions prior to 4.2.19 are affected; patches are available in 4.2.19 and version 5 and later.

## Affected products

- Svelte Svelte < 4.2.19

## Identifiers

- CVE-2024-45047
- GHSA-8266-84wp-wv5c

## Timeline

- 2024-08-30: disclosed
- 2024-08-30: patched: Version 4.2.19 and version 5 and later

## References

- [https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c](https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c)

## Related threats

- [Svelte XSS via spread attributes in SSR](https://junglewise.ai/threats/cve-2026-42599-svelte-xss-via-spread-attributes-in-ssr)
- [Svelte DOM clobbering leading to XSS in internal framework state](https://junglewise.ai/threats/cve-2026-42573-svelte-dom-clobbering-leading-to-xss-in-internal-framework-state)
- [Svelte ReDoS in svelte:element tag validation](https://junglewise.ai/threats/cve-2026-42567-svelte-redos-in-svelte-element-tag-validation)
- [Svelte XSS via insecure promise serialization in hydratable](https://junglewise.ai/threats/svelte-xss-via-insecure-promise-serialization-in-hydratable-3f504409)
- [Svelte XSS via HTML comment injection in SSR error boundary](https://junglewise.ai/threats/cve-2026-27902-svelte-xss-via-html-comment-injection-in-ssr-error-boundary)