Svelte's update from version 4.2.16 to 4.2.17 involves subtle backend tweaks, primarily impacting the package's distribution and internal organization. The core functionality and API exposed to developers remain consistent between these versions, ensuring a seamless transition for those already utilizing Svelte. Key dependencies related to web app enhancement stay unchanged, with packages like acorn, css-tree, magic-string, and those related to accessibility (aria-query, axobject-query), source map handling and code remapping being identical. This means existing Svelte applications will function without requiring code modifications due to this update.
The critical difference lies in the dist object which describes the package distribution details. 4.2.17z was released on May 13, 2024 while 4.2.16 was released on May 7, 2024. While the fileCount remains consistent at 250, the unpackedSize value saw a slight increase from 2,632,863 bytes to 2,632,899, suggesting minor alterations in the packaged files. These alterations are unlikely to affect the developer experience directly, and point towards improvements in documentation, build processes, or internal tooling. Therefore, upgrading from 4.2.16 to 4.2.17 is a low-risk operation, presenting stability and incremental improvements without introducing breaking changes.
All the vulnerabilities related to the version 4.2.17 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag