5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42599

CVE-2026-42599: Cross-site scripting via spread attributes in Svelte SSR

Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This issue has been patched in version 5.55.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42599

CVE-2026-42599:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
svelte	npm	<= 5.55.6	5.55.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue within Svelte's Server-Side Rendering (SSR) functionality, specifically when using spread attributes ({...props}). The root cause is the improper handling of untrusted data passed into these attributes, which allows attackers to inject malicious event handlers (e.g., onclick) into the rendered HTML.

The analysis of the security patches reveals two primary vulnerable functions on the server side:

encode in packages/svelte/src/internal/server/hydratable.js: This function had a classic JavaScript string replacement vulnerability. When serializing data for hydration, it used String.prototype.replace with a replacement value derived from user input. This allowed attackers to use special replacement patterns to break out of the intended structure and inject malicious code.
attributes in packages/svelte/src/internal/server/index.js: This function is responsible for rendering HTML attributes. It failed to block attributes with empty names, creating a loophole that could be used to bypass sanitization and inject malicious attributes during SSR.

A third function, get_setters in packages/svelte/src/internal/client/dom/elements/attributes.js, was also patched as a defense-in-depth measure. This client-side function was hardened to prevent spread attributes from modifying dangerous properties like innerHTML, mitigating the risk of DOM-based XSS during hydration.

An attacker exploiting this vulnerability could execute arbitrary JavaScript in the context of the user's browser, provided that the Svelte hydration process does not clean up the malicious element before an event (like mouseover) is triggered.

Vulnerable functions

encode

packages/svelte/src/internal/server/hydratable.js

The `encode` function was vulnerable to an injection attack. It used `String.prototype.replace` where the replacement string was constructed with potentially user-controlled data. An attacker could provide a string with special replacement patterns (e.g., `$&`, `$$`) to manipulate the serialized output, leading to a cross-site scripting (XSS) vulnerability. The patch mitigates this by using a function as the second argument to `replace`, which ensures the replacement string is treated as a literal value.

attributes

packages/svelte/src/internal/server/index.js

The `attributes` function, which processes and renders element attributes during server-side rendering (SSR), did not properly validate attribute names. It allowed empty string attribute names, which could be exploited to bypass security filters or create malformed HTML, leading to an XSS vulnerability when using spread attributes with untrusted data. The patch adds a check to explicitly disallow empty attribute names.

get_setters

packages/svelte/src/internal/client/dom/elements/attributes.js

The `get_setters` function determines which element properties can be updated via spread attributes on the client side. The original implementation did not prevent potentially dangerous properties like `innerHTML`, `textContent`, and `innerText` from being set. An attacker could exploit this by passing a malicious object to a spread attribute, leading to a DOM-based XSS vulnerability during the hydration process. The patch hardens this function by adding these properties to a blocklist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.