CVE-2022-25875: Svelte

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.

Affected products

• Svelte Svelte: before 3.49.0 (fixed in 3.49.0)

Published 2022-07-12. Last modified 2026-06-17.