GitHub Advisoryadvisory · npm

GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable

MEDIUM Published 2026-05-14 Modified 2026-05-14 Official page ↗
Ecosystem
npm
Packages
svelte
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-79
Reviewed
2026-05-14

Affected packages

• npm svelte: >= 5.46.0, < 5.55.7 → fixed in 5.55.7

Description

Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true: • you are using `hydratable` (an experimental feature at the time of this report) • you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References