Web Framework Vulnerability in Svelte Prior to Version 5.55.7

CVE-2026-42599

What is CVE-2026-42599?

Svelte, a performance-oriented web framework, has a vulnerability that arises when using spread syntax to render attributes from untrusted data. Specifically, prior to version 5.55.7, if developers spread user-controlled or external data into element attributes, there is a risk that malicious event handlers could be injected. This could allow attackers to execute arbitrary scripts in the victims' browsers, provided JavaScript is enabled and the hydration mechanism fails to reach the affected element before the event fires. The issue was resolved in version 5.55.7, and users are encouraged to upgrade to this version to mitigate the risk.

References