Svelte has a potential mXSS vulnerability due to improper HTML escaping
Summary
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Details
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
- If the string is an attribute value:
"->"&->&- Other characters -> No conversion
- Otherwise:
<-><&->&- Other characters -> No conversion
The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
PoC
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>then, alert(123) will be executed.
Impact
XSS, when using an attribute within a noscript tag
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | svelte | < 4.2.19 | 4.2.19 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
svelte- Disclosed
- 30.08.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8266-84wp-wv5c - CC BY 4.0
Vulnerability history: svelte
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 07.2022 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 13
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 12
-
Svelte has a potential mXSS vulnerability due to improper HTML escaping this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.