Read the docs
TI-2024-30159 Aliases CVE-2024-45047GHSA-8266-84wp-wv5c

Potential mXSS vulnerability due to improper HTML escaping in svelte

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a `noscript` tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed svelte (sveltejs): 4.2.19svelte (npm): 4.2.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sveltejssveltebefore 4.2.194.2.19Patch availableCNA
—svelte (npm)before 4.2.194.2.19Patch availableGHSA-8266-84wp-wv5c
  • svelte Vendorsveltejs Affected before 4.2.19 Fixed in 4.2.19 Patch available CNA
  • svelte (npm) Vendor— Affected before 4.2.19 Fixed in 4.2.19 Patch available GHSA-8266-84wp-wv5c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*before 4.2.19Vulnerablesveltejs
  • cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:* Versions before 4.2.19 Vulnerable ·sveltejs

Remediation

  • Fix · CNA svelte (sveltejs) Fixed in 4.2.19
  • Fix · GHSA-8266-84wp-wv5c svelte (npm) Fixed in 4.2.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45047
  2. 2026-10-03 Alias added: GHSA-8266-84wp-wv5c

References

Exploit 1

Advisory 1

Other 2

  • TI-2025-13940 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVSS 4.0MEDIUM 5.3
  • TI-2021-10070 The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to… CVSS 3.1HIGH 7.8
  • TI-2022-09436 Cross-site scripting (XSS) in svelte CVSS 3.1MEDIUM 6.1
  • TI-2026-30847 Svelte: ReDoS in `<svelte:element>` Tag Validation CVSS 4.0MEDIUM 5.9
  • TI-2026-30853 Svelte: XSS via DOM Clobbering of Internal Framework State CVSS 4.0MEDIUM 5.3
  • TI-2026-22246 Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers CVSS 4.0MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences