CVE-2026-42573

Svelte: XSS via DOM Clobbering of Internal Framework State

5.3 MediumFix available

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.34%Up 0.3 points since Jun 10, 2026

What each source reports

CVE List Score used 5.3

Svelte: XSS via DOM Clobbering of Internal Framework State

Record: CVE-2026-42573
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-79, CWE-79
Updated: 2026-11-02

EUVDEUVD-2026-35701 5.3

Record: EUVD-2026-35701
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rcqx-6q8c-2c42 5.3

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:

you are using attribute spreading on a form element
you are using attribute spreading or allow a dynamic value for the name attribute on an input or button element within that form
both of these are simultaneously user-controllable

<form {...spread1}>
  <input {...spread2}>
</form>

Record: GHSA-rcqx-6q8c-2c42
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.3

Record: CVE-2026-42573
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.3

Svelte: XSS via DOM Clobbering of Internal Framework State

Record: CVE-2026-42573
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-rcqx-6q8c-2c42 5.3

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:

you are using attribute spreading on a form element
you are using attribute spreading or allow a dynamic value for the name attribute on an input or button element within that form
both of these are simultaneously user-controllable

<form {...spread1}>
  <input {...spread2}>
</form>

Record: GHSA-rcqx-6q8c-2c42
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`svelte` npm	through 5.55.6	5.55.7
`svelte` npm	before 5.55.7	5.55.7

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42573 is a medium vulnerability (CVSS 5.3) in Svelte, published May 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in svelte 5.55.7.