The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration

Svelte: ReDoS in `<svelte:element>` Tag Validation

Svelte SSR attribute spreading includes inherited properties from prototype chain

Cross-site scripting via spread attributes in Svelte SSR

Svelte: XSS via DOM Clobbering of Internal Framework State

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

svelte performance oriented web framework

The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR…

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Svelte affected by XSS in SSR `<option>` element