sveltejs/svelte · Security
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
- GHSA ID
- GHSA-f3cj-j4f6-wq85
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Description
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using
hydratable(an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.
hydratable('someKey', () => [synchronousValue, promiseValue])
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')