Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Résumé
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise.
This issue affects Svelte: from 5.46.0 before 5.46.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory fluidattacks.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web registry.npmjs.org