p PatchFirst

CVE-2025-15265

CVE-2025-15265 · Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe escaping, allowing </script> to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise. This issue affects Svelte: from 5.46.0 before 5.46.3.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • svelte

    Versions
    • ≥ 5.46.0, < 5.46.3: Affected (custom)

    Update to 5.46.3

  • svelte npm

    Affected ranges
    • SEMVER: ≥ 5.46.0, < 5.46.4

    Update to 5.46.4

Original sources

Check your server →