Dismissed
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
10 packages
- svelte-check
- svelte-language-server
- nodePackages.svelte-check
- nodePackages_latest.svelte-check
- vscode-extensions.svelte.svelte-vscode
- tree-sitter-grammars.tree-sitter-svelte
- vimPlugins.nvim-treesitter-parsers.svelte
- python312Packages.tree-sitter-grammars.tree-sitter-svelte
- python313Packages.tree-sitter-grammars.tree-sitter-svelte
- python314Packages.tree-sitter-grammars.tree-sitter-svelte
- @LeSuisse dismissed
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
References
- https://github.com/sveltejs/svelte/security/advisories/GHSA-phwv-c562-gvmh x_refsource_CONFIRM
- https://github.com/sveltejs/svelte/commit/0df5abcae223058ceb95491470372065fb87951d x_refsource_MISC
- https://github.com/sveltejs/svelte/releases/tag/svelte%405.53.5 x_refsource_MISC
Affected products
svelte
- ==< 5.53.5
Ignored packages (10)
pkgs.svelte-check
Svelte code checker
pkgs.svelte-language-server
Language server (implementing the language server protocol) for Svelte
pkgs.nodePackages.svelte-check
Svelte Code Checker Terminal Interface
pkgs.nodePackages_latest.svelte-check
Svelte Code Checker Terminal Interface
pkgs.vscode-extensions.svelte.svelte-vscode
Svelte language support for VS Code
pkgs.tree-sitter-grammars.tree-sitter-svelte
None
-
nixos-unstable 0.0.0+rev=ae5199d
- nixpkgs-unstable 0.0.0+rev=ae5199d
- nixos-unstable-small 0.0.0+rev=ae5199d
pkgs.python312Packages.tree-sitter-grammars.tree-sitter-svelte
Python bindings for tree-sitter-svelte
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-svelte
Python bindings for tree-sitter-svelte
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-svelte
Python bindings for tree-sitter-svelte