GHSA-6738-r8g5-qwp3

Source

https://github.com/advisories/GHSA-6738-r8g5-qwp3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-6738-r8g5-qwp3/GHSA-6738-r8g5-qwp3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6738-r8g5-qwp3

Aliases

CVE-2025-15265

Published

2026-01-15T20:13:33Z

Modified

2026-01-15T22:52:46.930090Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

svelte vulnerable to Cross-site Scripting

Details

Summary

An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.

Details

When using the <code>hydratable</code> function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.

This key is embedded into a <script> block in the server-rendered <head> without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.

Impact

This is a cross-site scripting vulnerability affecting applications that have the experimental.async flag enabled and use hydratable with keys incorporating untrusted user input.

Impact: Arbitrary JS execution in the client’s browser.
Exploitability: Remote, single-request if key is attacker-controlled.
Typical Outcomes:
- Session/token theft
- DOM defacement
- CSRF bypass via injected JS
- Account takeover depending on cookie/session strategy

Affected applications should upgrade to a patched version immediately.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2026-01-15T20:16:03Z",
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T20:13:33Z"
}

References

Affected packages

npm / svelte

Package

Name: svelte; View open source insights on deps.dev
Purl: pkg:npm/svelte

Affected ranges

Type: SEMVER
Events: Introduced

5.46.0

Fixed

5.46.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-6738-r8g5-qwp3/GHSA-6738-r8g5-qwp3.json"

last_known_affected_version_range

"<= 5.46.3"