Svelte vulnerable to XSS when using objects during server-side rendering

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-25875 · ADVISORY
• sveltejs/svelte#7530 · WEB
• sveltejs/svelte commit f8605d6 · WEB
• sveltejs/svelte · PACKAGE
• snyk.io/vuln/SNYK-JS-SVELTE-2931080 · WEB
• sveltejs/svelte#7530%23issuecomment-1158575990 · Broken Link

svelte 的其他漏洞

• CVE-2026-42599中危 6.1Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, …
• CVE-2026-42573中危 6.1Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework s…
• CVE-2026-42567高危 7.5Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can ta…
• CVE-2026-27902中危 5.4Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being e…
• CVE-2026-27901中危 6.1Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contentedita…