GHSA-8266-84wp-wv5c Svelte has a potential mXSS vulnerability due to improper HTML escaping

• npm svelte: < 4.2.19 → fixed in 4.2.19

Summary A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19. Details Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules: • If the string is an attribute value: • `"` -> `&quot;` • `&` -> `&amp;` • Other characters -> No conversion • Otherwise: • ` `&lt;` • `&` -> `&amp;` • Other characters -> No conversion The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a `` tag. PoC A vulnerable page (`+page.svelte`): ```html import { page } from "$app/stores" // user input let href = $page.url.searchParams.get("href") ?? "https://example.com"; test ``` If a user accesses the following URL, ``` http://localhost:4173/?href=alert(123) ``` then, `alert(123)` will be executed. Impact XSS, when using an attribute within a noscript tag