Svelte HTML Injection Vulnerability in Server-Side Rendering

A vulnerability in the Svelte web framework prior to version 5.51.5 allows for HTML injection during server-side rendering. This issue arises when using `<svelte:element this={tag}>`, as the tag name is not properly validated or sanitized before being outputted as HTML. If the tag contains unexpected characters, it can lead to HTML injection in the server-side rendered output. Client-side rendering is not impacted.

Impact

Exploitation of this vulnerability could result in HTML injection in the server-side rendered output, potentially allowing for the inclusion of malicious HTML or scripts.

Remediation

Users can upgrade to Svelte version 5.51.5 or later to address this vulnerability.