GHSA-f3cj-j4f6-wq85

GHSA-f3cj-j4f6-wq85 · Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true: - you are using `hydratable` (an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`

CVSS 5.3 · Moyenne · Correctif disponible

Publication

2026-05-14T20:30:09Z

Mise à jour

2026-05-14T20:49:54.154680Z

Pile logicielle: node

Vérifiez votre serveur →