Svelte version 4.2.6 represents a minor update over its predecessor, 4.2.5, primarily focusing on internal improvements and bug fixes rather than introducing groundbreaking new features impacting the core development experience. Both versions maintain identical dependency and devDependency lists, indicating no changes in the underlying tools or external libraries used during compilation or testing. Key dependencies like acorn for parsing, css-tree for CSS processing, and magic-string for source code manipulation remain consistent, ensuring stability and compatibility for existing projects. Similarly, development tools like rollup for bundling, vitest for testing, and typescript for type checking remain unchanged, preserving a familiar development workflow.
The critical distinctions between the two versions lie in the resolved issues and refinements implemented in 4.2.6. While a detailed changelog would provide a comprehensive understanding, the increased unpackedSize of 4.2.6 (2630666 bytes) compared to 4.2.5 (2630660 bytes), though marginal, suggests minor code additions or adjustments, likely addressing specific edge cases or performance optimizations. The releaseDate also showcases that version 4.2.6 was released shortly after 4.2.5, further suggesting that this was a patch version. For developers, upgrading from 4.2.5 to 4.2.6 is recommended to benefit from these under-the-hood improvements, but major behavioral changes are not anticipated, ensuring a smooth transition without significant code modifications.
All the vulnerabilities related to the version 4.2.6 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag