Quick answers
- Is CVE-2026-42573 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42573 being exploited in the wild.
- How severe is CVE-2026-42573?
- Medium severity, with a CVSS score of 4, published 9 June 2026.
- Which products and versions are affected?
- svelte (npm) <= 5.55.6, SEMVER:introduced=0,fixed=5.55.7.
- Is there a fix for CVE-2026-42573?
- Yes. svelte (npm): upgrade to 5.55.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42573 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42573?
- Check whether you run svelte (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- svelte (npm): upgrade to 5.55.7 or later
npm install svelte@5.55.7
Technical details
Svelte is vulnerable to DOM Clobbering of its internal framework state, which can be escalated to Cross-Site Scripting (XSS). The vulnerability occurs when a developer uses attribute spreading ({...spread}) on a <form> element while simultaneously using attribute spreading or dynamic 'name' attributes on child <input> or <button> elements. If both the form attributes and the child element names are user-controllable, an attacker can 'clobber' internal properties that Svelte uses to manage the DOM. This allows for the injection of malicious scripts. The issue is fixed in Svelte version 5.55.7.
Affected products
- sveltejs svelte <= 5.55.6
Identifiers
- CVE-2026-42573
- GHSA-rcqx-6q8c-2c42
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Fixed in version 5.55.7
References
- https://api.github.com/users/elliott-with-the-longest-name-on-github
- https://github.com/elliott-with-the-longest-name-on-github
- https://api.github.com/users/elliott-with-the-longest-name-on-github/gists%7B/gist_id%7D
- https://api.github.com/users/elliott-with-the-longest-name-on-github/repos
- https://avatars.githubusercontent.com/u/76245373?v=4
- https://api.github.com/users/elliott-with-the-longest-name-on-github/events%7B/privacy%7D