CVE-2026-42573
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Jun 9, 2026
CISA due date
—
The record
Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | svelte | 0 | 5.55.7 |
Related vulnerabilities
- GHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State Same vulnerability
- CVE-2026-42567 Svelte is a performance oriented web framework. Also affects svelte
- CVE-2026-42599 Svelte is a performance oriented web framework. Also affects svelte
- GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable Also affects svelte
- GHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `` Tag Validation Also affects svelte
- GHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributes Also affects svelte
- GHSA-qgvg-pr8v-6rr3 Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers Also affects svelte
- GHSA-phwv-c562-gvmh Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and… Also affects svelte