XSS in Svelte
CVE-2026-42573
Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (24.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Svelte
- Sveltejs Svelte — versions < 5.55.7
Weakness classification (CWE)
References
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-42573?
- CVE-2026-42573 is a medium-severity vulnerability in Svelte, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-06-09.
- How severe is CVE-2026-42573?
- Medium severity. CVSS v3 base score is 6.1 out of 10.