Svelte is a popular JavaScript framework for building reactive web applications, known for its compiler-based approach that shifts work from runtime to compile time, resulting in highly performant and efficient code. Comparing versions 3.42.6 and 3.42.5 reveals subtle but important differences that developers should be aware of. Both versions share the same core development dependencies, including tools for testing, linting, and bundling like mocha, eslint, and rollup. They also rely on a consistent set of plugins for Rollup, such as those for JSON processing, code replacement, Sucrase integration, virtual modules, CommonJS support, and TypeScript handling.
The key distinction lies in the dist section, specifically the unpackedSize. Version 3.42.6 has an unpacked size of 6932605 bytes, while version 3.42.5 has a size of 6932426 bytes. This indicates that version 3.42.6 includes some new features, bug fixes or changes compared to the previous version. While the release notes would offer specific details, developers should generally upgrade to the newest version for any bug fixes and improvements. The difference in release dates also shows that one version is newer than the other (released five days apart to be exact), and developers should consider using the new version for the most up-to-date experience. Both versions are licensed under MIT and maintained by Rich Harris, and can be found on the official GitHub repository. Svelte's compilation process offers significant performance advantages, building lean and efficient web applications.
All the vulnerabilities related to the version 3.42.6 of the package
Svelte vulnerable to XSS when using objects during server-side rendering
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag