chore(deps): update dependency svelte to v5.55.7 [security] #6
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: TehRiehlDeal/skill-tree-portfolio#6
Reference in new issue
Block a user
This PR contains the following updates:
5.46.1→5.55.7svelte vulnerable to Cross-site Scripting
CVE-2025-15265 / GHSA-6738-r8g5-qwp3
More information
Details
Summary
An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of
hydratablekeys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.Details
When using the
hydratablefunction, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.This key is embedded into a
<script>block in the server-rendered<head>without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.Impact
This is a cross-site scripting vulnerability affecting applications that have the
experimental.asyncflag enabled and usehydratablewith keys incorporating untrusted user input.Affected applications should upgrade to a patched version immediately.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte SSR attribute spreading includes inherited properties from prototype chain
CVE-2026-27125 / GHSA-crpf-4hrx-3jrp
More information
Details
In server-side rendering, attribute spreading on elements (e.g.
<div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments whereObject.prototypehas already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
CVE-2026-27121 / GHSA-f7gr-6p89-r883
More information
Details
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte affected by XSS in SSR
<option>elementCVE-2026-27119 / GHSA-h7h7-mm68-gmrc
More information
Details
In certain circumstances, the server-side rendering output of an
<option>element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte SSR does not validate dynamic element tag names in
<svelte:element>CVE-2026-27122 / GHSA-m56q-vw4c-c2cp
More information
Details
When using
<svelte:element this={tag}>in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte vulnerable to XSS during SSR with contenteditable
bind:innerTextandbind:textContentCVE-2026-27901 / GHSA-phwv-c562-gvmh
More information
Details
The contents of
bind:innerTextandbind:textContentoncontenteditableelements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
GHSA-f3cj-j4f6-wq85
More information
Details
Contents of
hydratablepromises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:hydratable(an experimental feature at the time of this report)hydratable('someKey', () => [synchronousValue, promiseValue])Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte SSR vulnerable to cross-site scripting via spread attributes
CVE-2026-42599 / GHSA-pr6f-5x2q-rwfp
More information
Details
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.
This is similar to but different from CVE-2026-27121.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
CVE-2026-42573 / GHSA-rcqx-6q8c-2c42
More information
Details
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
You are vulnerable if all of the following is true:
nameattribute on an input or button element within that formSeverity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/svelte (svelte)
v5.55.7Compare Source
Patch Changes
fix: prevent XSS on
hydratablefrom user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)chore: bump devalue (#18219)
fix: disallow empty attribute names during SSR (
547853e2406a2147ad7fb5ffeba95b01bd9642da)fix: harden regex (
d2375e2ebcab5c88feb5652f1a9d621b8f06b259)fix: move Svelte runtime properties to symbols (
e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)v5.55.6Compare Source
Patch Changes
fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)
fix: keep dependencies of
$state.eager/pending(#18218)fix: reapply context after transforming error during SSR (#18099)
fix: don't rebase just-created batches (#18117)
chore: allow
nullforpendingin typings (#18201)fix: flush eager effects in production (#18107)
fix: rethrow error of failed iterable after calling
return()(#18169)fix: account for proxified instance when updating
bind:this(#18147)fix: ensure scheduled batch is flushed if not obsolete (#18131)
fix: resolve stale deriveds with latest value (#18167)
chore: remove unnecessary
increment_pendingcalls (#18183)fix: correctly compile component member expressions for SSR (#18192)
fix: reset
source.updatedstack traces afterflush(#18196)fix: replacing async 'blocking' strategy with 'merging' (#18205)
fix: allow
@debugtags to reference awaited variables (#18138)fix: re-run fallback props if dependencies update (#18146)
fix: abort running obsolete async branches (#18118)
fix: ignore comments when reading CSS values (#18153)
fix: wrap
Promise.allinsaveduring SSR (#18178)fix: ignore false-positive errors of
$inspectdependencies (#18106)v5.55.5Compare Source
Patch Changes
fix: don't mark deriveds while an effect is updating (#18124)
fix: do not dispatch introstart event with animation of animate directive (#18122)
v5.55.4Compare Source
Patch Changes
fix: never mark a child effect root as inert (#18111)
fix: reset context after waiting on blockers of
@constexpressions (#18100)fix: keep flushing new eager effects (#18102)
v5.55.3Compare Source
Patch Changes
fix: ensure proper HMR updates for dynamic components (#18079)
fix: correctly calculate
@constblockers (#18039)fix: freeze deriveds once their containing effects are destroyed (#17921)
fix: defer error boundary rendering in forks (#18076)
fix: avoid false positives for reactivity loss warning (#18088)
v5.55.2Compare Source
Patch Changes
fix: invalidate
@consttags based on visible references in legacy mode (#18041)fix: handle parens in template expressions more robustly (#18075)
fix: disallow
--inidPrefix(#18038)fix: correct types for
ontoggleon<details>elements (#18063)fix: don't override
$destroy/set/oninstance methods in dev mode (#18034)fix: unskip branches of earlier batches after commit (#18048)
fix: never set derived.v inside fork (#18037)
fix: skip rebase logic in non-async mode (#18040)
fix: don't reset status of uninitialized deriveds (#18054)
v5.55.1Compare Source
Patch Changes
fix: unlink errored and otherwise finished batch (#18264)
perf: walk composedPath() directly in delegated event propagation (#18268)
fix: transfer effects when merging batches (#18254)
fix: allow
$derived(await ...)in disconnected effect roots (#18273)fix: remove temporary raw-text hydration markers (#18269)
fix: propagate async
@constblockers through closure references so template expressions like{(() => host)()}correctly wait for the awaited value (#18309)fix: properly unlink batches (#18298)
fix: settle discarded batch (#18290)
fix: declare
let:directives before{@const}declarations on slotted elements (#18271)fix: resume outro-ed branches if they were kept around (#18291)
fix: avoid waterfall-warning when async resolves to same value (#18297)
fix: correctly coordinate component-level effects inside async blocks (#18260)
fix: make unnecessary commit work less likely (#18263)
chore: add tag name to
a11y_click_events_have_key_eventswarning (#18272)fix: catch rejected promises while merging/committing (#18266)
v5.55.0Compare Source
Minor Changes
Patch Changes
v5.54.1Compare Source
Patch Changes
fix: hydration comments during hmr (#17975)
fix: null out
effect.bindestroy_effect(#17980)fix: group sync statements (#17977)
fix: defer batch resolution until earlier intersecting batches have committed (#17162)
fix: properly invoke
iterator.return()during reactivity loss check (#17966)fix: remove trailing semicolon from {@const} tag printer (#17962)
v5.54.0Compare Source
Minor Changes
css,runes,customElementcompiler options to be functions (#17951)Patch Changes
v5.53.13Compare Source
Patch Changes
fix: ensure
$inspectafter top level await doesn't break builds (#17943)fix: resume inert effects when they come from offscreen (#17942)
fix: don't eagerly access not-yet-initialized functions in template (#17938)
fix: discard batches made obsolete by commit (#17934)
fix: ensure "is standalone child" is correctly reset (#17944)
fix: remove nodes in boundary when work is pending and HMR is active (#17932)
v5.53.12Compare Source
Patch Changes
fix: update
select.__valueonchange(#17745)chore: add
invarianthelper for debugging (#17929)fix: ensure deriveds values are correct across batches (#17917)
fix: handle async RHS in
assignment_value_stale(#17925)fix: avoid traversing clean roots (#17928)
v5.53.11Compare Source
Patch Changes
fix: remove
untrackcircular dependency (#17910)fix: recover from errors that leave a corrupted effect tree (#17888)
fix: properly lazily evaluate RHS when checking for
assignment_value_stale(#17906)fix: resolve boundary in correct batch when hydrating (#17914)
chore: rebase batches after process, not during (#17900)
v5.53.10Compare Source
Patch Changes
v5.53.9Compare Source
Patch Changes
bind:thiscleanup timing (#17885)v5.53.8Compare Source
Patch Changes
fix:
{@html}no longer duplicates content insidecontenteditableelements (#17853)fix: don't access inert block effects (#17882)
fix: handle asnyc updates within pending boundary (#17873)
perf: avoid re-traversing the effect tree after
$:assignments (#17848)chore: simplify scheduling logic (#17805)
v5.53.7Compare Source
Patch Changes
fix: correctly add __svelte_meta after else-if chains (#17830)
perf: cache element interactivity and source line splitting in compiler (#17839)
chore: avoid rescheduling effects during branch commit (#17837)
perf: optimize CSS selector pruning (#17846)
fix: preserve original boundary errors when keyed each rows are removed during async updates (#17843)
perf: avoid O(n²) name scanning in scope
generateandunique(#17844)fix: preserve each items that are needed by pending batches (#17819)
v5.53.6Compare Source
Patch Changes
perf: optimize parser hot paths for faster compilation (#17811)
fix:
SvelteMapincorrectly handles keys withundefinedvalues (#17826)fix: SvelteURL
searchsetter now returns the normalized value, matching native URL behavior (#17828)fix: visit synthetic value node during ssr (#17824)
fix: always case insensitive event handlers during ssr (#17822)
chore: more efficient effect scheduling (#17808)
perf: optimize compiler analysis phase (#17823)
fix: skip redundant batch.apply (#17816)
chore: null out current_batch before committing branches (#17809)
v5.53.5Compare Source
Patch Changes
fix: escape
innerTextandtextContentbindings ofcontenteditable(0df5abcae223058ceb95491470372065fb87951d)fix: sanitize
transformErrorvalues prior to embedding in HTML comments (0298e979371bb583855c9810db79a70a551d22b9)v5.53.4Compare Source
Patch Changes
fix: set server context after async transformError (#17799)
fix: hydrate if blocks correctly (#17784)
fix: handle default parameters scope leaks (#17788)
fix: prevent flushed effects from running again (#17787)
v5.53.3Compare Source
Patch Changes
fix: render
:catchof#awaitblock with correct key (#17769)chore: pin aria-query@5.3.1 (#17772)
fix: make string coercion consistent to
toString(#17774)v5.53.2Compare Source
Patch Changes
fix: update expressions on server deriveds (#17767)
fix: further obfuscate
node:cryptoimport from overzealous static analysis (#17763)v5.53.1Compare Source
Patch Changes
fix: ensure
$inspectafter top level await doesn't break builds (#17943)fix: resume inert effects when they come from offscreen (#17942)
fix: don't eagerly access not-yet-initialized functions in template (#17938)
fix: discard batches made obsolete by commit (#17934)
fix: ensure "is standalone child" is correctly reset (#17944)
fix: remove nodes in boundary when work is pending and HMR is active (#17932)
v5.53.0Compare Source
Minor Changes
feat: allow comments in tags (#17671)
feat: allow error boundaries to work on the server (#17672)
Patch Changes
fix: use TrustedHTML to test for customizable
<select>support, where necessary (#17743)fix: ensure head effects are kept in the effect tree (#17746)
chore: deactivate current_batch by default in unset_context (#17738)
v5.52.0Compare Source
Minor Changes
{@html}expressions (#17701)Patch Changes
fix: repair dynamic component truthy/falsy hydration mismatches (#17737)
fix: re-run non-render-bound deriveds on the server (#17674)
v5.51.5Compare Source
Patch Changes
fix: check to make sure
svelte:elementtags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)fix: misc option escaping and backwards compatibility (#17741)
fix: strip event handlers during SSR (
a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)fix: replace usage of
for inwithfor of Object.keys(f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)fix: always escape option body in SSR (
f7c80da18c215e3727c2a611b0b8744cc6e504c5)chore: upgrade
devalue(#17739)v5.51.4Compare Source
Patch Changes
chore: proactively defer effects in pending boundary (#17734)
fix: detect and error on non-idempotent each block keys in dev mode (#17732)
v5.51.3Compare Source
Patch Changes
fix: prevent event delegation logic conflicting between svelte instances (#17728)
fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#17712)
fix: locate Rollup annontaion friendly to JS downgraders (#17724)
fix: run effects in pending snippets (#17719)
v5.51.2Compare Source
Patch Changes
fix: take async into consideration for dev delegated handlers (#17710)
fix: emit state_referenced_locally warning for non-destructured props (#17708)
v5.51.1Compare Source
Patch Changes
fix: don't crash on undefined
document.contentType(#17707)fix: use symbols for encapsulated event delegation (#17703)
v5.51.0Compare Source
Minor Changes
TrustedTypesfor HTML handling where supported (#16271)Patch Changes
fix: sanitize template-literal-special-characters in SSR attribute values (#17692)
fix: follow-up formatting in
print()— flush block-level elements into separate sequences (#17699)fix: preserve delegated event handlers as long as one or more root components are using them (#17695)
v5.50.3Compare Source
Patch Changes
fix: take into account
nodeNamecase sensitivity on XHTML pages (#17689)fix: render
multipleandselectedattributes as empty strings for XHTML compliance (#17689)fix: always lowercase HTML elements, for XHTML compliance (#17664)
fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#17682)
fix: propagate
$effecterrors to<svelte:boundary>(#17684)v5.50.2Compare Source
Patch Changes
fix: resolve
effect_update_depth_exceededwhen usingbind:valueon<select>with derived state in legacy mode (#17645)fix: don't swallow
DOMExceptionwhenmedia.play()fails inbind:paused(#17656)chore: provide proper public type for
parseCssresult (#17654)fix: robustify blocker calculation (#17676)
fix: reduce if block nesting (#17662)
v5.50.1Compare Source
Patch Changes
fix: render boolean attribute values as empty strings for XHTML compliance (#17648)
fix: prevent async render tag hydration mismatches (#17652)
v5.50.0Compare Source
Minor Changes
Patch Changes
fix: ensure infinite effect loops are cleared after flushing (#17601)
fix: allow
{#key NaN}(#17642)fix: detect store in each block expression regardless of AST shape (#17636)
fix: treat
<menu>like<ul>/<ol>for a11y role checks (#17638)fix: add vite-ignore comment inside dynamic crypto import (#17623)
chore: wrap JSDoc URLs in
@seeand@linktags (#17617)fix: properly hydrate already-resolved async blocks (#17641)
fix: emit
each_key_duplicateerror in production (#16724)fix: exit resolved async blocks on correct node when hydrating (#17640)
v5.49.2Compare Source
Patch Changes
chore: remove SvelteKit data attributes from elements.d.ts (#17613)
fix: avoid erroneous async derived expressions for blocks (#17604)
fix: avoid Cloudflare warnings about not having the "node:crypto" module (#17612)
fix: reschedule effects inside unskipped branches (#17604)
v5.49.1Compare Source
Patch Changes
fix: merge consecutive large text nodes (#17587)
fix: only create async functions in SSR output when necessary (#17593)
fix: properly separate multiline html blocks from each other in
print()(#17319)fix: prevent unhandled exceptions arising from dangling promises in <script> (#17591)
v5.49.0Compare Source
Minor Changes
ShadowRootInitobject to custom elementshadowoption (#17088)Patch Changes
fix: throw for unset
createContextget on the server (#17580)fix: reset effects inside skipped branches (#17581)
fix: preserve old dependencies when updating reaction inside fork (#17579)
fix: more conservative assignment_value_stale warnings (#17574)
fix: disregard
popoverelements when determining whether an element has content (#17367)fix: fire introstart/outrostart events after delay, if specified (#17567)
fix: increment signal versions when discarding forks (#17577)
v5.48.5Compare Source
Patch Changes
fix: run boundary
onerrorcallbacks in a microtask, in case they result in the boundary's destruction (#17561)fix: prevent unintended exports from namespaces (#17562)
fix: each block breaking with effects interspersed among items (#17550)
v5.48.4Compare Source
Patch Changes
v5.48.3Compare Source
Patch Changes
fix: hydration failing with settled async blocks (#17539)
fix: add pointer and touch events to a11y_no_static_element_interactions warning (#17551)
fix: handle false dynamic components in SSR (#17542)
fix: avoid unnecessary block effect re-runs after async work completes (#17535)
fix: avoid using dev-mode array.includes wrapper on internal array checks (#17536)
v5.48.2Compare Source
Patch Changes
waitfunction from internal client index (#17530)v5.48.1Compare Source
Patch Changes
fix: hoist snippets above const in same block (#17516)
fix: properly hydrate await in
{@html}(#17528)fix: batch resolution of async work (#17511)
fix: account for empty statements when visiting in transform async (#17524)
fix: avoid async overhead for already settled promises (#17461)
fix: better code generation for const tags with async dependencies (#17518)
v5.48.0Compare Source
Minor Changes
parseCssfromsvelte/compiler(#17496)Patch Changes
fix: handle non-string values in
svelte:elementthisattribute (#17499)fix: faster deduplication of dependencies (#17503)
v5.47.1Compare Source
Patch Changes
selectedcontentreactivity (#17486)v5.47.0Compare Source
Minor Changes
<select>elements (#17429)Patch Changes
fix: mark subtree of svelte boundary as dynamic (#17468)
fix: don't reset static elements with debug/snippets (#17477)
v5.46.4Compare Source
Patch Changes
devalue.unevalto serializehydratablekeys (ef81048e238844b729942441541d6dcfe6c8ccca)v5.46.3Compare Source
Patch Changes
fix: reconnect clean deriveds when they are read in a reactive context (#17362)
fix: don't transform references of function declarations in legacy mode (#17431)
fix: notify deriveds of changes to sources inside forks (#17437)
fix: always reconnect deriveds in get, when appropriate (#17451)
fix: prevent derives without dependencies from ever re-running (
286b40c4526ce9970cb81ddd5e65b93b722fe468)fix: correctly update writable deriveds inside forks (#17437)
fix: remove
$inspectcalls after await expressions when compiling for production server code (#17407)fix: clear batch between runs (#17424)
fix: adjust
locproperty ofProgramnodes created from<script>elements (#17428)fix: don't revert source to UNINITIALIZED state when time travelling (#17409)
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.