GHSA-gw32-9rmw-qwww

Source

https://github.com/advisories/GHSA-gw32-9rmw-qwww

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-gw32-9rmw-qwww/GHSA-gw32-9rmw-qwww.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gw32-9rmw-qwww

Published

2026-01-16T21:02:56Z

Modified

2026-02-03T03:17:01.517258Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

svelte is vulnerable to XSS with textarea bind:value

Details

Summary

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

Details

In SSR, <textarea bind:value={...}> does not have its value escaped when it is rendered into the HTML as <textarea>...</textarea>.

PoC

Put this in a server-side-rendered Svelte component:

<script>
  let value = `test'"></textarea>&lt;script` + `>alert('BIM');&lt;/sc` + `ript>`;
</script>

&lt;textarea bind:value />

Impact

Only affects SSR
Needs a <textarea bind:value> filled by user content via two-way binding

Database specific

{
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-16T21:02:56Z",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

npm / svelte

Package

Name: svelte; View open source insights on deps.dev
Purl: pkg:npm/svelte

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.59.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-gw32-9rmw-qwww/GHSA-gw32-9rmw-qwww.json"