GHSA-f3cj-j4f6-wq85

GHSA-f3cj-j4f6-wq85 · Svelte: SSR XSS via Insecure Promise Serialization in hydratable

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true: - you are using `hydratable` (an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`

CVSS 5.3 · Medium · Fix available

Published

2026-05-14T20:30:09Z

Updated

2026-05-14T20:49:54.154680Z

Stack: node

Check your server →