Packages / svelte / Security

ModerateVulnerabilityGHSA-pr6f-5x2q-rwfpCVE-2026-42599Published 14 May 2026

Svelte SSR vulnerable to cross-site scripting via spread attributes

Affected releases · svelte

  • 5.x5.0.0 – 5.55.6Fixed in 5.55.7
  • 4.x and older0.0.1 – 4.2.20No fix, no longer updated

On 5.x, the newest line:

npm install svelte@5.55.7
5.x

  1. Affected

    5.0.0 – 5.55.6

    325 releases

  2. Fixed

    5.55.7 – 5.57.2

    18 releases, latest

4.x

  1. Affected

    4.0.0 – 4.2.20

    30 releases

3.x

  1. Affected

    3.0.0 – 3.59.2

    152 releases

2.x

  1. Affected

    2.0.0 – 2.16.1

    57 releases

1.x

  1. Affected

    1.0.0 – 1.64.1

    178 releases

0.x

  1. Affected

    0.0.1 – 0.3.0

    8 releases

768 stable releases of svelte, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from CVE-2026-27121.