Svelte, a popular framework for building cybernetically enhanced web applications, saw a release of version 3.52.0 on October 15, 2022, following closely after version 3.51.0 released on October 10, 2022. Both versions share the same core description and developer tooling, offering a suite of devDependencies crucial for development, testing, and linting, including tools like Acorn, ESLint, Rollup, and TypeScript. Developers familiar with the Svelte ecosystem will find the development experience consistent across the two versions.
A key difference between the two releases lies in the unpacked size of the distribution package. Version 3.52.0 weighs in at 8,928,020 bytes while the previous version is slightly smaller at 8,870,949 bytes. While the file count remains the same at 248, this increase may hint at bug fixes, performance improvements, or small feature enhancements included in the newer version. Developers should consider these differences for potential impact on build times or application size.
For developers, updating from Svelte 3.51.0 to 3.52.0 likely represents a low-risk opportunity to benefit from any refinements. Always it's advisable to review the official Svelte changelog and release notes for a detailed breakdown of the changes. If there is no immediate need, testing in a development environment may be prudent before deploying the update to production. These point releases often bring subtle improvements and bug fixes that enhance the overall stability and performance of the framework.
All the vulnerabilities related to the version 3.52.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag