Description
Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from `transformError`. Version 5.53.5 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | svelte | >= 5.53.0, < 5.53.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | svelte | >= 5.53.0, < 5.53.5 | 5.53.5 | GHSA-qgvg-pr8v-6rr3 |