SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.
Summary
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Details
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
- If the string is an attribute value: - " -> " - & -> & - Other characters -> No conversion - Otherwise: - < -> < - & -> & - Other characters -> No conversion
The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
PoC
A vulnerable page (+page.svelte): html <script> import { page } from "$app/stores"
// user input let href = $page.url.searchParams.get("href") ?? "https://example.com"; </script>
<noscript> <a href={href}>test</a> </noscript>
If a user accesses the following URL, http://localhost:4173/?href=</noscript><script>alert(123)</script> then, alert(123) will be executed.
Impact
XSS, when using an attribute within a noscript tag
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.