CVE-2025-15265
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Summary
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Original description
The description as published by the source.
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise.
This issue affects Svelte: from 5.46.0 before 5.46.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory fluidattacks.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web registry.npmjs.org