Answer in brief
CVE-2025-15265 records a Medium severity vulnerability in Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in svelte. The current sources do not mark it as known exploited. The current feed maps svelte (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps svelte (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sveltenpm | >=5.46.0,<=5.46.3 | Not reported |
Published upstream
Jan 15, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Jan 15, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
## Summary An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of `hydratable` keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML. ## Details When using the [`hydratable`](https://svelte.dev/docs/svelte/hydratable) function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser. This key is embedded into a `<script>` block in the server-rendered `<head>` without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response. ## Impact This is a cross-site scripting vulnerability affecting applications that have the `experimental.async` flag enabled and use `hydratable` with keys incorporating untrusted user input. - **Impact**: Arbitrary JS execution in the client’s browser. - **Exploitability**: Remote, single-request if key is attacker-controlled. - **Typical Outcomes**: - Session/token theft - DOM defacement - CSRF bypass via injected JS - Account takeover depending on cookie/session strategy Affected applications should upgrade to a patched version immediately.
Quoted source text, attributed separately from HOL analysis.