Svelte SSR attribute spreading includes inherited properties from prototype chain
Affected releases · svelte
- 5.x5.0.0 – 5.51.4Fixed in 5.51.5
- 4.x and older0.0.1 – 4.2.20No fix, no longer updated
On 5.x, the newest line:
npm install svelte@5.51.5Affected
5.0.0 – 5.51.4
300 releases
Fixed
5.51.5 – 5.57.2
43 releases, latest
Affected
4.0.0 – 4.2.20
30 releases
Affected
3.0.0 – 3.59.2
152 releases
Affected
2.0.0 – 2.16.1
57 releases
Affected
1.0.0 – 1.64.1
178 releases
Affected
0.0.1 – 0.3.0
8 releases
Is your project affected?
Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.
What happens
In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.