Executive brief
Svelte is a popular web framework for building user interfaces. During server-side rendering, the framework can inadvertently include inherited properties from JavaScript's prototype chain when spreading attributes on HTML elements. If the prototype chain has been polluted (typically by a third-party library), this can cause unexpected HTML attributes to appear in the rendered output or cause the server to throw errors, affecting page rendering and availability.
Technical details
The vulnerability exists in Svelte's server-side rendering (SSR) implementation for attribute spreading (e.g., <div {...attrs}>). When spreading object properties, the code enumerates inherited properties from the prototype chain instead of using only own properties. This is a prototype pollution exposure: in environments where Object.prototype has been polluted by another library or code, the inherited polluted properties are included in the SSR output. The attack requires a precondition (Object.prototype pollution) and affects only SSR; client-side rendering is unaffected. The vulnerability was fixed in Svelte 5.51.5 (commit 73098bb).
Affected products
- Svelte Svelte <=5.51.4
Timeline
- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in version 5.51.5