CVE-2026-42573CWE-79

Svelte: XSS via DOM Clobbering of Internal Framework State

Medium · published June 9, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00349 · 27.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-09T16:21Z
EPSS history
Timeline
  • 09 JUN 16:21Z
    Svelte: XSS via DOM Clobbering of Internal Framework State
    cvelistv5