GHSA-f3cj-j4f6-wq85

Source

https://github.com/advisories/GHSA-f3cj-j4f6-wq85

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f3cj-j4f6-wq85/GHSA-f3cj-j4f6-wq85.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f3cj-j4f6-wq85

Published

2026-05-14T20:30:09Z

Modified

2026-05-14T20:49:54Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Details

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-14T20:30:09Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / svelte

Package

Name: svelte; View open source insights on deps.dev
Purl: pkg:npm/svelte

Affected ranges

Type: SEMVER
Events: Introduced

5.46.0

Fixed

5.55.7

Database specific

last_known_affected_version_range

"<= 5.55.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f3cj-j4f6-wq85/GHSA-f3cj-j4f6-wq85.json"