CVE-2026-42599

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 5.55.7

Description When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. This allows an attacker to inject malicious event handlers that execute in the browser if an application spreads user-controlled or external data as element attributes. This occurs when JavaScript is enabled in the browser and Svelte's hydration mechanism—the process of attaching event listeners to server-rendered HTML—does not reach the element before the event is triggered.

Recommendations Update to version 5.55.7.