Svelte 4.2.3 is a minor release following version 4.2.2 in the Svelte framework, a popular choice for building cybernetically enhanced web applications. Both versions share the same core dependencies, including acorn for parsing, code-red for code generation, and css-tree for CSS parsing. Key development dependencies like Rollup for bundling, Vitest for testing, and TypeScript for static typing remain consistent. This suggests that the fundamental toolchain and underlying architecture haven't undergone significant changes. However, a subtle difference exists in the unpacked size of the distribution package; 4.2.3 is slightly larger, indicating potential bug fixes, performance improvements, or minor feature additions.
The release date difference points to a relatively short interval between the two versions which may indicate that the newer version contains resolutions to critical bugs uncovered in widespread use of the previous one or important performance improvements. For developers, this means that upgrading to 4.2.3 is likely a low-risk endeavor, offering the benefits of the latest refinements without introducing major breaking changes. While specific details of the changes aren't explicitly listed, migrating to the newest version ensures you are building your applications with the up-to-date performance and bug fixes of the Svelte compiler. Carefully checking the Svelte changelog for specific details between these versions is highly advised.
All the vulnerabilities related to the version 4.2.3 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag