Packages / svelte / Security

ModerateVulnerabilityGHSA-wv8q-r932-8hc7CVE-2022-25875SNYK-JS-SVELTE-2931080Published 13 Jul 2022

Svelte vulnerable to XSS when using objects during server-side rendering

Affected releases · svelte

  • 3.x3.0.0 – 3.48.0Fixed in 3.49.0
  • 2.x and older0.0.1 – 2.16.1No fix, no longer updated

On 3.x, the newest line:

npm install svelte@3.49.0
5.x

  1. Not affected

    5.0.0 – 5.57.2

    343 releases, latest

3.x

  1. Affected

    3.0.0 – 3.48.0

    136 releases

  2. Fixed

    3.49.0 – 3.59.2

    16 releases

2.x

  1. Affected

    2.0.0 – 2.16.1

    57 releases

1.x

  1. Affected

    1.0.0 – 1.64.1

    178 releases

0.x

  1. Affected

    0.0.1 – 0.3.0

    8 releases

768 stable releases of svelte, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.

What happens

The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.