{"id":"GHSA-f3cj-j4f6-wq85","aliases":[],"status":"published","title":"Svelte: SSR XSS via Insecure Promise Serialization in hydratable","description":"Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:\n- you are using `hydratable` (an experimental feature at the time of this report)\n- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () =\u003e [synchronousValue, promiseValue])`","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-14T20:30:09Z","modified":"2026-05-14T20:49:54Z","fixes":[{"ecosystem":"npm","package":"svelte","fixed_in":["5.55.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"svelte","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.46.0"},{"last_affected":"5.55.6"},{"fixed":"5.55.7"}]}]},{"source":"osv","ecosystem":"npm","package":"svelte","ranges":[{"type":"SEMVER","events":[{"introduced":"5.46.0"},{"fixed":"5.55.7"}]}]}],"references":[{"url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85","tags":["web"]},{"url":"https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4","tags":["web"]},{"url":"http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f3cj-j4f6-wq85"},{"url":"https://github.com/sveltejs/svelte","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f3cj-j4f6-wq85","title":"Svelte: SSR XSS via Insecure Promise Serialization in hydratable","description":"Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:\n- you are using `hydratable` (an experimental feature at the time of this report)\n- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () =\u003e [synchronousValue, promiseValue])`","status":"published","published":"2026-05-14T20:30:09Z","modified":"2026-05-14T20:30:13Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"osv":[{"id":"GHSA-f3cj-j4f6-wq85","title":"Svelte: SSR XSS via Insecure Promise Serialization in hydratable","description":"Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:\n- you are using `hydratable` (an experimental feature at the time of this report)\n- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () =\u003e [synchronousValue, promiseValue])`","status":"published","published":"2026-05-14T20:30:09Z","modified":"2026-05-14T20:49:54.15468Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}