Svelte 3.59.1 represents a minor update to the Svelte JavaScript framework, refining the preceding 3.59.0 version. Both versions share the same core description as "Cybernetically enhanced web apps," underscoring Svelte's commitment to efficient and performant web development. Examining the devDependencies, we observe a consistent toolkit across the two versions, encompassing essential utilities like rollup for bundling, typescript and @typescript-eslint for type checking and linting, eslint for code quality, plus testing frameworks like mocha and jsdom. This consistent dependency stack ensures a stable development environment for Svelte projects.
A notable difference lies in the dist object. Svelte 3.59.0 has a fileCount of 277 and an unpackedSize of 11058022, while Svelte 3.59.1 has a fileCount of 263 and a smaller unpackedSize of 10624099. The decreased size and file count in version 3.59.1 likely indicate optimizations in the bundled output, potentially leading to slightly faster load times and improved performance for end-users. Moreover, 3.59.1 was released on May 8, 2023, shortly after 3.59.0's release on May 5, 2023, suggesting a quick turnaround to address any discovered issues or implement minor enhancements. For developers, this quick update indicates that the Svelte team is actively maintaining the library and focused on swift issue resolution. When upgrading to Svelte 3.59.1, confirm any breaking changes from 3.59.0 aren't impacting your project.
All the vulnerabilities related to the version 3.59.1 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag