GHSA-pr6f-5x2q-rwfp

Source

https://github.com/advisories/GHSA-pr6f-5x2q-rwfp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-pr6f-5x2q-rwfp/GHSA-pr6f-5x2q-rwfp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pr6f-5x2q-rwfp

Aliases

CVE-2026-42599

Published

2026-05-14T20:19:42Z

Modified

2026-05-14T20:35:15.889706Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

Svelte SSR vulnerable to cross-site scripting via spread attributes

Details

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from CVE-2026-27121.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed_at": "2026-05-14T20:19:42Z",
    "github_reviewed": true
}

References

Affected packages

npm / svelte

Package

Name: svelte; View open source insights on deps.dev
Purl: pkg:npm/svelte

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.55.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-pr6f-5x2q-rwfp/GHSA-pr6f-5x2q-rwfp.json"

last_known_affected_version_range

"<= 5.55.6"