CVE-2026-42573

MEDIUM

Svelte: XSS via DOM Clobbering of Internal Framework State

Title source: cna

Description

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.

References (2)

Core 2

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42

X_Refsource_Misc x_refsource_misc

https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7

Scores

CVSS v3 6.1

EPSS 0.0021

EPSS Percentile 11.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (3)

npm/svelte 0 - 5.55.7npm

svelte/svelte < 5.55.7

sveltejs/svelte < 5.55.7

Published Jun 09, 2026

Tracked Since Jun 09, 2026