Executive brief
Svelte is a popular JavaScript framework used to build web applications. When using server-side rendering with a textarea element that binds user-controlled data via bind:value, the framework fails to properly escape the value, allowing an attacker to inject malicious JavaScript code that executes in users' browsers. This can lead to session hijacking, credential theft, or other attacks against site visitors.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in Svelte's server-side rendering (SSR) logic. When a textarea element uses two-way binding (bind:value={...}) with untrusted data, the value is inserted into the HTML output without proper escaping, allowing an attacker to break out of the textarea context and inject arbitrary HTML and JavaScript. The vulnerability requires SSR to be enabled and the textarea's value to be populated from user-controlled input. The flaw was introduced in version 3.0.0 and fixed in version 3.59.2. Attackers can exploit this via network access to applications using affected versions without requiring authentication or special privileges.
Affected products
- Svelte Svelte >=3.0.0, <3.59.2
Timeline
- 2026-01-16: disclosed
- 2026-01-16: patched: Version 3.59.2 released with fix