Svelte HTML Injection Vulnerability in Server-Side Rendered Option Elements

A vulnerability in the Svelte web framework, specifically in versions 5.39.3 prior to 5.51.4, allows for HTML injection in the server-side rendering (SSR) output of `<option>` elements. This issue arises because the content of these elements is not properly escaped, potentially leading to the injection of malicious HTML. It's important to note that this vulnerability does not affect client-side rendering.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, where an attacker injects malicious HTML that is executed in the user's browser.

Remediation

Users can upgrade to Svelte version 5.51.5 to address this vulnerability.