Svelte version 3.6.2 is a minor update to the popular open-source JavaScript compiler that transforms declarative components into highly efficient vanilla JavaScript. Released shortly after version 3.6.1, this patch introduces subtle improvements and bug fixes, ensuring a smoother development experience. While the core functionality remains consistent, developers upgrading from 3.6.1 will benefit from increased stability and the resolution of any potential edge-case scenarios uncovered in the previous release. Examining the fileCount and unpackedSize in the dist object, we can see that 3.6.2 increased number of files in two, likely due to dedicated fixes.
Both versions share the same core dependencies and devDependencies, including crucial tools like rollup for bundling, typescript and @typescript-eslint for enhanced code quality and static analysis, as well as testing frameworks like mocha and jsdom. This signifies that the development workflow and tooling remain consistent across these versions, minimizing disruption for existing Svelte projects. If you're deciding between versions for a new project, opting for 3.6.2 is probably the only right choice, as it builds on the foundation of 3.6.1, incorporating important refinements without introducing breaking changes. The quick release cycle between the two versions indicates a commitment to rapid iteration and responsiveness to community feedback, reinforcing Svelte's position as a actively-maintained framework.
All the vulnerabilities related to the version 3.6.2 of the package
Svelte vulnerable to XSS when using objects during server-side rendering
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag