SNYK-JS-SVELTE-2931080: Cross-site Scripting (XSS)

Q: Which applications are exposed to this issue?

Applications using Svelte versions before 3.49.0 are exposed when they use server-side rendering and render attributes from objects that may have a custom toString() function.

Q: What does an attacker need to exploit it?

An attacker needs a way to cause an application to render a crafted object with a custom toString() function in an SSR attribute context. The vector is network-accessible and requires no privileges, but user interaction is required.

Q: Is client-side-only Svelte rendering affected?

The provided vulnerability details specifically identify improper attribute escaping during server-side rendering. They do not establish that client-side-only rendering is affected.

Q: What should be done if an immediate upgrade is not possible?

Avoid rendering untrusted objects in SSR attributes, particularly objects that can supply a custom toString() function. Ensure values used for rendered attributes are validated or converted to safe primitive values before rendering.

Published Jul 12, 2022

Updated

The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.

Affected Software

1 affected component

npm/svelte<3.49.0

Event History

Jul 12, 2022

CVE Published

via OSV·02:20 PM

Data Sourced

via OSV·02:20 PM

DescriptionSeverity

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Svelte versions before 3.49.0 are exposed when they use server-side rendering and render attributes from objects that may have a custom toString() function.

What does an attacker need to exploit it?

An attacker needs a way to cause an application to render a crafted object with a custom toString() function in an SSR attribute context. The vector is network-accessible and requires no privileges, but user interaction is required.

Is client-side-only Svelte rendering affected?

The provided vulnerability details specifically identify improper attribute escaping during server-side rendering. They do not establish that client-side-only rendering is affected.

What should be done if an immediate upgrade is not possible?

Avoid rendering untrusted objects in SSR attributes, particularly objects that can supply a custom toString() function. Ensure values used for rendered attributes are validated or converted to safe primitive values before rendering.

SNYK-JS-SVELTE-2931080: Cross-site Scripting (XSS)

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is client-side-only Svelte rendering affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is client-side-only Svelte rendering affected?

What should be done if an immediate upgrade is not possible?