GitHub Advisoryadvisory · npm

GHSA-wv8q-r932-8hc7 Svelte vulnerable to XSS when using objects during server-side rendering

MEDIUM Published 2022-07-13 Modified 2023-09-07 Official page ↗
Aliases
CVE-2022-25875
Ecosystem
npm
Packages
svelte
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-15

Affected packages

• npm svelte: < 3.49.0 → fixed in 3.49.0

Description

The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.

Related

Alias · CVE (1)

  • CVE-2022-25875 The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References