Executive brief
Svelte is a popular web framework used to build user interfaces. A vulnerability exists where an attacker can manipulate the internal state of a web page by providing malicious input to forms that use specific coding patterns. This could allow an attacker to execute unauthorized scripts in a user's browser, potentially leading to the theft of sensitive information or session hijacking.
Technical details
Svelte is vulnerable to DOM Clobbering of its internal framework state, which can be escalated to Cross-Site Scripting (XSS). The vulnerability occurs when a developer uses attribute spreading ({...spread}) on a <form> element while simultaneously using attribute spreading or dynamic 'name' attributes on child <input> or <button> elements. If both the form attributes and the child element names are user-controllable, an attacker can 'clobber' internal properties that Svelte uses to manage the DOM. This allows for the injection of malicious scripts. The issue is fixed in Svelte version 5.55.7.
Affected products
- sveltejs svelte <= 5.55.6
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Fixed in version 5.55.7
References
- https://api.github.com/users/elliott-with-the-longest-name-on-github
- https://github.com/elliott-with-the-longest-name-on-github
- https://api.github.com/users/elliott-with-the-longest-name-on-github/gists%7B/gist_id%7D
- https://api.github.com/users/elliott-with-the-longest-name-on-github/repos
- https://avatars.githubusercontent.com/u/76245373?v=4
- https://api.github.com/users/elliott-with-the-longest-name-on-github/events%7B/privacy%7D