Executive brief
Svelte is a popular framework for building web user interfaces. A vulnerability exists in its server-side rendering (SSR) component where untrusted data passed as element attributes can include malicious scripts. If exploited, an attacker could execute unauthorized code in a user's browser, potentially leading to account takeover or data theft, specifically in scenarios where the page's interactive elements haven't fully loaded yet.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Svelte's Server-Side Rendering (SSR) when using spread attributes (e.g., {...data}). When an application spreads user-controlled or external data as element attributes, event handler properties (like 'onclick') are included in the rendered HTML output instead of being sanitized or restricted. This allows an attacker to inject malicious JavaScript event handlers. The vulnerability is specifically exploitable if the user's browser has JavaScript enabled but Svelte's hydration mechanism has not yet reached the vulnerable element before the malicious event is triggered. This issue is addressed in version 5.55.7.
Affected products
- Svelte Svelte <= 5.55.6
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Fixed in version 5.55.7