CVE-2026-42573
CVE-2026-42573 · Svelte: XSS via DOM Clobbering of Internal Framework State
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7
- https://access.redhat.com/security/cve/CVE-2026-42573
- https://bugzilla.redhat.com/show_bug.cgi?id=2487093
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-42573