{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.55.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "svelte"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.46.0"
            },
            {
              "fixed": "5.55.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:30:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:\n- you are using `hydratable` (an experimental feature at the time of this report)\n- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable(\u0027someKey\u0027, () =\u003e [synchronousValue, promiseValue])`",
  "id": "GHSA-f3cj-j4f6-wq85",
  "modified": "2026-05-14T20:30:09Z",
  "published": "2026-05-14T20:30:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sveltejs/svelte"
    },
    {
      "type": "WEB",
      "url": "http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Svelte: SSR XSS via Insecure Promise Serialization in hydratable"
}