Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-09T16:22:46 svelte: Svelte: Cross-Site Scripting via untrusted data in spread attributes 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CWE-79

Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This issue has been patched in version 5.55.7.

A flaw was found in Svelte. When an application uses spread syntax to render attributes from untrusted data, event handler properties are included in the generated HTML output. This allows a remote attacker to inject malicious event handlers that can execute in a victim's web browser, leading to client-side script execution (Cross-Site Scripting). This vulnerability occurs if the user's browser has JavaScript enabled and Svelte's hydration mechanism does not process the affected element before the event is triggered.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Build of Podman Desktop - Tech Preview Fix deferred rhdesktop/rh-podman-desktop-ext-bootc-rhel10 https://www.cve.org/CVERecord?id=CVE-2026-42599 https://nvd.nist.gov/vuln/detail/CVE-2026-42599 https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7 https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp