CVE-2025-15265
Medium · 5.4svelte vulnerable to Cross-site Scripting
CVSS
5.4
EPSS
0.3%
Published
Jan 15, 2026
CISA due date
—
The record
An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of `hydratable` keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | svelte | 5.46.0 | 5.46.4 |
Related vulnerabilities
- GHSA-6738-r8g5-qwp3 svelte vulnerable to Cross-site Scripting Same vulnerability
- CVE-2026-42567 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42599 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42573 Svelte is a performance oriented web framework. Also affects svelte
- GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable Also affects svelte
- GHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State Also affects svelte
- GHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `` Tag Validation Also affects svelte
- GHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributes Also affects svelte