svelte is vulnerable to XSS with textarea bind:value

ÉLEVÉEGHSA-gw32-9rmw-qwww · Published 16/01/2026 · updated 03/02/2026

En bref

Package	Affected versions	Patched versions
svelte npm	`≥ 3.0.0, < 3.59.2`	`3.59.2`

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

In SSR, <textarea bind:value={...}> does not have its value escaped when it is rendered into the HTML as <textarea>...</textarea>.

Put this in a server-side-rendered Svelte component:

<script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

npm

≥ 3.0.0, < 3.59.2

3.59.2

Description

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

In SSR, <textarea bind:value={...}> does not have its value escaped when it is rendered into the HTML as <textarea>...</textarea>.

Put this in a server-side-rendered Svelte component:

<script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />

Autres vulnérabilités de svelte

Tout voir →