svelte vulnerable to Cross-site Scripting
Summary
An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.
Details
When using the hydratable function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.
This key is embedded into a <script> block in the server-rendered <head> without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.
Impact
This is a cross-site scripting vulnerability affecting applications that have the experimental.async flag enabled and use hydratable with keys incorporating untrusted user input.
- Impact: Arbitrary JS execution in the client’s browser.
- Exploitability: Remote, single-request if key is attacker-controlled.
- Typical Outcomes:
- Session/token theft
- DOM defacement
- CSRF bypass via injected JS
- Account takeover depending on cookie/session strategy
Affected applications should upgrade to a patched version immediately.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | svelte | >= 5.46.0, < 5.46.4 | 5.46.4 |
References
- https://github.com/sveltejs/svelte/security/advisories/GHSA-6738-r8g5-qwp3
- https://nvd.nist.gov/vuln/detail/CVE-2025-15265
- https://github.com/sveltejs/svelte/commit/ef81048e238844b729942441541d6dcfe6c8ccca
- https://fluidattacks.com/advisories/lydian
- https://github.com/sveltejs/svelte
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.46.4
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
svelte- Disclosed
- 15.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6738-r8g5-qwp3 - CC BY 4.0
Vulnerability history: svelte
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 07.2022 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 13
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 12
-
svelte vulnerable to Cross-site Scripting this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.