Every CVE Search/ Get API key

CVE-2024-45047

Potential mXSS vulnerability due to improper HTML escaping in svelte

5.4 MediumFix available

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a noscript tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.36%Up 0.3 points since Aug 31, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.4

Potential mXSS vulnerability due to improper HTML escaping in svelte

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a noscript tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-45047
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-2530 5.4

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a noscript tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2024-2530
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8266-84wp-wv5c 5.1

Svelte has a potential mXSS vulnerability due to improper HTML escaping

Summary

A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.

Details

Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:

  • If the string is an attribute value:
    • " -> "
    • & -> &
    • Other characters -> No conversion
  • Otherwise:
    • < -> &lt;
    • & -> &amp;
    • Other characters -> No conversion

The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.

PoC

A vulnerable page (+page.svelte):

<script>
import { page } from "$app/stores"

// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>

<noscript>
  <a href={href}>test</a>
</noscript>

If a user accesses the following URL,

http://localhost:4173/?href=</noscript><script>alert(123)</script>

then, alert(123) will be executed.

Impact

XSS, when using an attribute within a noscript tag

Record
GHSA-8266-84wp-wv5c
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.4

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a noscript tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-45047
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

Potential mXSS vulnerability due to improper HTML escaping in svelte

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a noscript tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-45047
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-8266-84wp-wv5c 5.1

Svelte has a potential mXSS vulnerability due to improper HTML escaping

Summary

A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.

Details

Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:

  • If the string is an attribute value:
    • " -> &quot;
    • & -> &amp;
    • Other characters -> No conversion
  • Otherwise:
    • < -> &lt;
    • & -> &amp;
    • Other characters -> No conversion

The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.

PoC

A vulnerable page (+page.svelte):

<script>
import { page } from "$app/stores"

// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>

<noscript>
  <a href={href}>test</a>
</noscript>

If a user accesses the following URL,

http://localhost:4173/?href=</noscript><script>alert(123)</script>

then, alert(123) will be executed.

Impact

XSS, when using an attribute within a noscript tag

Record
GHSA-8266-84wp-wv5c
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1776040402 No score

TuxCare security update for svelte (5 CVEs)

TuxCare rebuilt svelte to address 5 CVEs. Fixed in 3.59.2-tuxcare.1.

Record
CLSA-2026-1776040402
Updated
2026-11-02
OSVCLSA-2026-1776126838 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.

Record
CLSA-2026-1776126838
Updated
2026-11-02
OSVCLSA-2026-1776213244 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 1.64.1-tuxcare.1.

Record
CLSA-2026-1776213244
Updated
2026-11-02
OSVCLSA-2026-1776213252 No score

TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 0.3.0-tuxcare.1.

Record
CLSA-2026-1776213252
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
svelte
npm
 before 4.2.19
4.2.19
svelte
TuxCare:npm
From an advisory covering 5 CVEs
 3.59.2-tuxcare.0 up to 3.59.2-tuxcare.1, plus listed versions
3.59.2
3.59.2-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 2.16.1-tuxcare.0 up to 2.16.1-tuxcare.1, plus listed versions
2.16.1
2.16.1-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 1.64.1-tuxcare.0 up to 1.64.1-tuxcare.1, plus listed versions
1.64.1
1.64.1-tuxcare.1
svelte
TuxCare:npm
From an advisory covering 6 CVEs
 0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions
0.3.0
0.3.0-tuxcare.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45047 is a medium vulnerability (CVSS 5.4) in Svelte, published August 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in svelte 4.2.19.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open