CVE-2026-42599: Cross-site scripting via spread attributes in Svelte SSR
Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This issue has been patched in version 5.55.7.
Other sources
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.
This is similar to but different from CVE-2026-27121.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/svelteto a version that resolves this vulnerability.Fixed in 5.55.7 - Configuration
Do not use spread syntax to render attributes from untrusted or external data. Instead explicitly assign only the allowed attributes and sanitize or validate input before rendering.
Svelte (SSR) use of spread attributes with untrusted data = avoid - Compensating control
On the server side, strip or remove event-handler-style properties (for example keys that begin with "on") from any attribute objects derived from user-controlled or external data before rendering or spreading them into elements.
- Operational
Audit the codebase for occurrences of attribute spread (e.g., {...attrs}) that consume user-controlled or external data, remediate those usages by sanitizing or explicitly whitelisting attributes, and upgrade projects to Svelte v5.55.7.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42599?
CVE-2026-42599 is considered a high severity vulnerability due to potential remote code execution through injected event handlers.
How do I fix CVE-2026-42599?
To fix CVE-2026-42599, upgrade Svelte to version 5.55.7 or later to prevent event handler injection from untrusted data.
What kind of attack can exploit CVE-2026-42599?
CVE-2026-42599 can be exploited through Cross-Site Scripting (XSS) attacks, where malicious event handlers are injected into rendered HTML.
Which versions of Svelte are affected by CVE-2026-42599?
CVE-2026-42599 affects all Svelte versions up to and including 5.55.6.
What should I do if I cannot update to version 5.55.7 for CVE-2026-42599?
If unable to update, implement stringent validation and sanitization of all user-controlled data used in the spread syntax to mitigate the vulnerability.