Svelte version 4.2.10 is a patch release following closely after version 4.2.9, both iterations of the popular JavaScript framework focused on building cybernetically enhanced web applications. The core dependencies of the library remain consistent between the two versions, with packages like acorn, code-red, css-tree, and various utilities for sourcemap handling and AST traversal remaining at the same versions. Similarly, the development dependencies are also identical, indicating no major tooling updates or build process changes between the releases. This means developers can expect a seamless upgrade experience with no breaking changes anticipated in the core functionalities.
The key differences between version 4.2.9 and 4.2.10 lie primarily in the dist section. This reveals differences in the packaging and distribution of the library on npm. Specifically, version 4.2.10 has a fileCount of 250, one more than 4.2.9, which had 249 files. Additionally, the unpackedSize for 4.2.10 is 2631970 bytes, a slight increase from the 2631295 bytes in 4.2.9. This suggests that the patch likely included a small update, perhaps a bug fix, documentation change, or minor optimization, which resulted in a slightly larger package size and an extra distributed file. The release date of 4.2.10 is January 5th, 2024, showing a quick turnaround from 4.2.9's release on January 17th, showcasing Svelte's active maintainership. Developers should upgrade to benefit from these subtle refinements and ensure they're using the most stable and up-to-date codebase.
All the vulnerabilities related to the version 4.2.10 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag