EUVD-2026-35703
GHSA-pr6f-5x2q-rwfp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (https://github.com/sveltejs/svelte).
CVSS VectorVendor: https://github.com/sveltejs/svelte
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 npm packages depend on svelte (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.55.7.
DescriptionCVE.org
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.
This is similar to but different from CVE-2026-27121.
AnalysisAI
Cross-site scripting in Svelte versions up to 5.55.6 allows remote attackers to inject malicious event handlers via spread syntax when rendering untrusted data as element attributes. The vulnerability executes in victims' browsers only when JavaScript is enabled and Svelte's hydration mechanism does not process the vulnerable element before the injected event fires. Vendor-released patch: version 5.55.7.
Technical ContextAI
Svelte is a JavaScript framework that compiles components to vanilla JavaScript at build time. The vulnerability exists in Svelte's server-side rendering (SSR) layer when using spread syntax ({...data}) to apply user-controlled or external data as HTML element attributes. Unlike traditional frameworks that handle attribute binding at runtime, Svelte's compilation process should sanitize spread attributes to prevent event handler properties (such as onclick, onmouseover) from being rendered as literal HTML attributes. The underlying issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a cross-site scripting flaw. The affected component npm/svelte <= 5.55.6 fails to neutralize event handler properties during SSR, allowing them to pass through as rendered HTML. The fix moves Svelte runtime properties to symbols and hardens the handling of spread attributes, preventing event handler injection during the hydration process.
RemediationAI
Upgrade Svelte to version 5.55.7 or later immediately. The patched version moves Svelte runtime properties to symbols, preventing them from being included in spread attribute output, and hardens attribute handling during SSR. Organizations unable to upgrade immediately should avoid using spread syntax ({...data}) with untrusted data sources as element attributes; instead, explicitly bind known-safe attributes using normal attribute binding syntax, or pre-validate and sanitize external data before spreading. Ensure all dynamic components are hydrated early in the page load before user interactions can trigger injected events. Review any server-side templates or components that use spread syntax to identify and remediate patterns that accept external or user-controlled data.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today