CVE-2026-42573
Description
A flaw was found in Svelte, a web framework. An attacker could exploit a DOM clobbering vulnerability, which allows manipulation of the Document Object Model (DOM) to overwrite internal framework state on elements. This could potentially lead to Cross-Site Scripting (XSS) attacks, enabling the attacker to inject malicious scripts into web pages viewed by other users.
Statement
Severity: Important
This issue is classified as Important severity for deployments where untrusted content can influence Svelte-rendered markup, because:
Conditions for Exploitation: The flaw is a DOM clobbering issue in the Svelte framework. Exploitation requires an application to render user-influenced markup using Svelte patterns where attacker-controlled HTML can clobber internal framework state (for example, unsafe spread of form or element attributes in a Svelte component). Remote exploitation requires a victim to interact with attacker-influenced content in the affected application (RH CVSS UI:R).
Impact Limitations: The vulnerability is in a front-end UI framework dependency, not a standalone network service. Impact is limited to the security context of the application that embeds the vulnerable Svelte runtime.
Upstream Stance: The upstream Svelte project and GHSA rate this issue Moderate (CVSS 5.3). Red Hat rates it Important with RH CVSS 8.1 where the affected product exposes a network-reachable or user-driven UI that could process untrusted markup through the vulnerable Svelte code paths.
Red Hat build of Podman Desktop 1.0 and 1.1 ship a bundled Svelte dependency, but after engineering review Red Hat Product Security agrees these streams are not affected. Podman Desktop is an Electron-based desktop client, not a public-facing web application. There is no realistic path for an adversary to supply the user-influenced attribute spreads required to trigger DOM clobbering in this product context. The vulnerable Svelte code is not controllable by an adversary in the way the issue describes for typical web deployments.
Mitigation
For Red Hat build of Podman Desktop 1.0 and 1.1, no mitigation or dependency update is required. These streams are not affected; the bundled Svelte runtime is not exposed to adversary-controlled input in a way that enables this DOM clobbering flaw.
Other products or components that embed Svelte in a context where untrusted markup can reach vulnerable spread patterns should plan to update the Svelte dependency to version 5.55.7 or later when applicable to their shipping model.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | 6.1 | 8.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Changed | Unchanged |
| Confidentiality | High | Low | High |
| Integrity Impact | High | Low | High |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
