sveltejs/svelte · Security
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
- GHSA ID
- GHSA-rcqx-6q8c-2c42
- CVE ID
- CVE-2026-42573
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Description
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
You are vulnerable if all of the following is true:
- you are using attribute spreading on a form element
- you are using attribute spreading or allow a dynamic value for the
nameattribute on an input or button element within that form - both of these are simultaneously user-controllable
<form {...spread1}>
<input {...spread2}>
</form>
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')