svelte vulnerabilities
Cybernetically enhanced web apps
- Registry
- npm
- Latest
- 5.57.2
- License
- MIT
14 known advisories
The latest version, 5.57.2, is not affected by any of them. Projects on older versions may be.
npm install svelte@5.57.2Security advisories for svelte
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
- Affected
- >=5.46.0 <5.55.7
- Fixed in
- 5.55.7
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte: ReDoS in `<svelte:element>` Tag Validation
- Affected
- >=5.51.5 <5.55.7
- Fixed in
- 5.55.7
Svelte SSR vulnerable to cross-site scripting via spread attributes
- Affected
- <5.55.7
- Fixed in
- 5.55.7
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
- Affected
- >=5.53.0 <5.53.5
- Fixed in
- 5.53.5
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- Affected
- <5.53.5
- Fixed in
- 5.53.5
Svelte SSR attribute spreading includes inherited properties from prototype chain
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
- Affected
- <5.51.5
- Fixed in
- 5.51.5
Svelte affected by XSS in SSR `<option>` element
- Affected
- >=5.39.3 <5.51.5
- Fixed in
- 5.51.5
svelte is vulnerable to XSS with textarea bind:value
- Affected
- >=3.0.0 <3.59.2
- Fixed in
- 3.59.2
svelte vulnerable to Cross-site Scripting
- Affected
- >=5.46.0 <5.46.4
- Fixed in
- 5.46.4
Svelte has a potential mXSS vulnerability due to improper HTML escaping
- Affected
- <4.2.19
- Fixed in
- 4.2.19
Svelte vulnerable to XSS when using objects during server-side rendering
- Affected
- <3.49.0
- Fixed in
- 3.49.0
Which of your client projects still run an old svelte?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.