Svelte 3.50.1 is a minor patch release following version 3.50.0 of the popular JavaScript framework renowned for its "cybernetically enhanced web apps." While both versions share the same core description and developer dependencies, including crucial tools like Rollup, TypeScript, and ESLint, subtle differences indicate the focus of the update. The primary distinction lies in the "dist" section, revealing adjustments in the distribution package. Svelte 3.50.1 sees an increase in fileCount from 246 to 247, potentially indicating the addition of a new file or a previously excluded one now included in the package. A notable increase in unpackedSize from 8,712,808 bytes to 8,800,726, approximately 88KB, suggests code additions, modifications, or even optimizations that contribute to a slightly larger bundle size. For developers already using Svelte 3.50.0, upgrading to 3.50.1 is recommended. While the nature of changes demands investigation, given the minor version bump, we expect bug fixes, performance enhancements that don't introduce new features. The updated release date of September 8, 2022, compared to September 2, 2022 confirms that those fixes were critical and that's why the release has been shipped fast. Always check the [official Svelte changelog](https://github.com/sveltejs/svelte/blob/master/CHANGELOG.md).
All the vulnerabilities related to the version 3.50.1 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag