Svelte version 3.55.0 introduces subtle enhancements and refinements over its predecessor, 3.54.0. Both versions retain the core functionality of "Cybernetically enhanced web apps," emphasizing Svelte's commitment to efficient and performant web development. Examining the devDependencies reveals that both versions share a nearly identical dependency list, suggesting a focus on internal improvements and bug fixes rather than a major overhaul of features. While the specific changelog details aren't provided, the increment in fileCount from 245 to 247 and unpackedSize from 9673183 to 9738416 bytes hints at the addition of new modules, potentially related to enhanced tooling or minor feature implementations.
For developers, upgrading from 3.54.0 to 3.55.0 should be a relatively straightforward process, given the consistent dependency structure. The lack of significant changes implies that existing Svelte applications are unlikely to experience breaking changes. The update probably brings minor improvements, potentially enhancing the developer experience through updated tooling or resolving smaller issues identified in the previous version, contributing to a more polished and stable development environment. Users are advised to check the official Svelte changelog for a complete listing of the changes between the two versions if available.
All the vulnerabilities related to the version 3.55.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag