Svelte Cross-Site Scripting Vulnerability in Server-Side Rendering

A cross-site scripting (XSS) vulnerability has been identified in the Svelte web framework, affecting versions prior to 5.51.5. The issue arises during server-side rendering when spread syntax is used to render attributes from untrusted data. In such cases, event handler properties can be inadvertently included in the HTML output. This allows attackers to inject malicious event handlers that execute in the browsers of users.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Svelte version 5.51.5 or later to address this vulnerability.