Svelte 4.0.2 is a minor release following closely on the heels of Svelte 4.0.1 in the Svelte framework, a popular choice for building fast and efficient web applications. Both versions share the same core dependencies, ensuring a consistent development experience. Key dependencies include acorn for JavaScript parsing, css-tree for CSS parsing and manipulation, along with tools for accessibility (aria-query, axobject-query), code transformation (magic-string, code-red) and source map handling (@ampproject/remapping, @jridgewell/trace-mapping, @jridgewell/sourcemap-codec).
The devDependencies also remain largely identical, featuring essential testing and build tools like jsdom, vitest, rollup, and esbuild. Also Typescript it's still in the same version, along with Playwright for end-to-end testing.
Developers considering upgrading from 4.0.1 to 4.0.2 should note the slight increase in unpacked size (from 2619493 to 2621840), potentially indicating minor bug fixes or performance improvements. The release date difference (June 29th to July 3rd) suggests a quick follow-up release, emphasizing the Svelte team's commitment to stability and rapid iteration. While the core feature set remains the same, developers are advised to review the changelog for specific fixes that might address issues encountered in version 4.0.1. Svelte continues to offer a compelling option for building reactive web apps with a focus on performance and developer productivity.
All the vulnerabilities related to the version 4.0.2 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag