CVE-2026-42573
Svelte: XSS via DOM Clobbering of Internal Framework State
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.
| CWE | CWE-79 |
| Vendor | sveltejs |
| Product | svelte |
| Published | Jun 9, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for sveltejs svelte
Be the first to know when new high vulnerabilities affecting sveltejs svelte are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
sveltejs / svelte
< 5.55.7
References
github.com: https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42 github.com: https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-42573 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2487093 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json