CVE-2022-25875: Cross-site Scripting (XSS)
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Other sources
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25875?
CVE-2022-25875 is a high-severity vulnerability due to Cross-site Scripting (XSS) risks.
How do I fix CVE-2022-25875?
To fix CVE-2022-25875, upgrade the Svelte package to version 3.49.0 or above.
Which versions of Svelte are affected by CVE-2022-25875?
CVE-2022-25875 affects all Svelte versions before 3.49.0.
What type of vulnerability is CVE-2022-25875?
CVE-2022-25875 is a Cross-site Scripting (XSS) vulnerability.
How can CVE-2022-25875 be exploited?
CVE-2022-25875 can be exploited through improper input sanitization and escaping in server-side rendering when using certain objects.