Svelte: SSR XSS via Insecure Promise Serialization in hydratable

MEDIOGHSA-f3cj-j4f6-wq85 · Published 14/05/2026 · updated 14/05/2026

In breve

GHSA-f3cj-j4f6-wq85 è una vulnerabilità MEDIO che riguarda svelte.
Correzione: aggiornare a 5.55.7 o successiva.

Package	Affected versions	Patched versions
svelte npm	`≥ 5.46.0, < 5.55.7`	`5.55.7`

Description

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

References

sveltejs/svelte security advisory · WEB
sveltejs/svelte commit a16ebc6 · WEB
sveltejs/svelte · PACKAGE
sveltejs/svelte release [email protected] · WEB

Altre vulnerabilità di svelte

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

svelte

npm

≥ 5.46.0, < 5.55.7

5.55.7

Description

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

Altre vulnerabilità di svelte

Vedi tutto →