QSearchQSearch

CVE-2026-42573

6.1 MEDIUM

Svelte is a performance oriented web framework

Published: 2026-06-09 · Last updated: 2026-06-11

Severity and scoring

CVSS
6.1 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
CWE-79

Affected products

VendorProduct
sveltesvelte

Description

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-42599 — Svelte is a performance oriented web framework (6.1 MEDIUM)
  • CVE-2026-42570 — Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job (7.5 HIGH)
  • CVE-2026-42567 — Svelte is a performance oriented web framework (7.5 HIGH)

Same CWE

  • CVE-2026-9125 — The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_ov... (6.4 MEDIUM)
  • CVE-2026-42653 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS (7.1 HIGH)
  • CVE-2026-46489 — SolidInvoice is an open-source invoicing platform (8.1 HIGH)
  • CVE-2026-8589 — GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0... (7.3 HIGH)
  • CVE-2026-10087 — GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2... (8.7 HIGH)