Svelte Event Handler Injection Vulnerability via Spread Syntax in Untrusted Data

A cross-site scripting vulnerability has been identified in Svelte versions prior to 5.55.7. When spread syntax is used to render attributes from untrusted data, event handler properties can be inadvertently included in the HTML output. This allows attackers to inject malicious event handlers that execute in the context of the victim's browser. The issue arises only if JavaScript is enabled and Svelte's hydration process does not reach the affected element before the event is triggered.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected event handlers can execute malicious scripts in the context of the user's browser.

Remediation

Users can upgrade to Svelte version 5.55.7 or later to address this vulnerability.