CVE-2025-15265
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
概要
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise.
This issue affects Svelte: from 5.46.0 before 5.46.3.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory fluidattacks.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web registry.npmjs.org