svelte@2.9.5 vulnerabilities

svelte is a package for building web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to a mismatch between attribute value and other string sanitization rules. An attacker can execute scripts by injecting malicious content into an attribute in a <noscript> tag.

Upgrade svelte to version 4.2.19 or higher.

svelte is a package for building web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.

Upgrade svelte to version 3.49.0 or higher.

svelte is a package for building web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when objects are rendered directly to attribute values as unescaped strings. This means an object with a custom toString() can result in raw html injection.

Upgrade svelte to version 3.46.5 or higher.

svelte is a package for building web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when spread attributes in the ssr files are unsanitized and can therefore be attack vectors for untrusted user input.

Upgrade svelte to version 2.9.8 or higher.