Svelte 3.31.1 is a minor patch release following Svelte 3.31.0, focusing primarily on dependency updates and refinements rather than introducing major new features. Developers upgrading from 3.31.0 will appreciate the bump in several key development dependencies, optimizing your build and development workflow. Notably, tslib moves from version 1.10.0 to 2.0.3, reflecting improvements in TypeScript support. Crucially, the @typescript-eslint suite sees significant updates, with both @typescript-eslint/parser and @typescript-eslint/eslint-plugin jumping from version 3.0.2 to 4.9.0. Paired with the typescript upgrade going from 3.5.3 to 3.7.5 This brings enhanced and more accurate TypeScript linting and parsing.
Security is improved with the bumps from eslint 7.1.0 to 7.15.0 that probably solved some vulnerabilities found in the previous releases.
In summary, while the core Svelte compiler and runtime likely remain largely consistent between the two versions, 3.31.1 offers a smoother, more robust development experience thanks to these dependency upgrades. This release emphasizes stability and incorporates recent improvements in the wider JavaScript and TypeScript ecosystem, ensuring that developers have access to the latest tools and best practices. For most Svelte developers, upgrading to 3.31.1 is recommended to benefit from these enhancements in the tooling.
All the vulnerabilities related to the version 3.31.1 of the package
Svelte vulnerable to XSS when using objects during server-side rendering
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag