Answer in brief
CVE-2026-42599 records a Medium severity vulnerability in Svelte SSR vulnerable to cross-site scripting via spread attributes. The current sources do not mark it as known exploited. The current feed maps svelte (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps svelte (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sveltenpm | <=5.55.6 | 5.55.7 |
Published upstream
May 14, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Jun 9, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This is similar to but different from [CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121).
Quoted source text, attributed separately from HOL analysis.