CVE catalog
CVE-2026-42599
Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML o
- Severity
- Medium · CVSS 5.1
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.21% · Oct 25, 2026
A flaw was found in Svelte. When an application uses spread syntax to render attributes from untrusted data, event handler properties are included in the generated HTML output. This allows a remote attacker to inject malicious event handlers that can execute in a victim's web browser, leading to client-side script execution (Cross-Site Scripting). This vulnerability occurs if the user's browser has JavaScript enabled and Svelte's hydration mechanism does not process the affected element before the event is triggered. svelte: Svelte: Cross-Site Scripting via untrusted data in spread attributes The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | svelte | Not reported | 5.55.7 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | svelte | cpe | Not reported | 5.55.7 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: