CVE-2024-45047 Potential mXSS vulnerability due to improper HTML escaping in svelte
Attackers can execute malicious scripts via mutation XSS in Svelte's server-side rendering due to improper HTML escaping in noscript tags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-45047?
CVE-2024-45047 is a medium-severity cross-site scripting vulnerability in sveltejs svelte, published on 30 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a `noscript` tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-45047?
2 open source packages ship an affected version, including svelte. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
svelte npm | All versions | 4.2.19 |
svelte npm | All versions | 4.2.19 |
Products include Svelte Svelte.
How do I fix CVE-2024-45047?
Upgrade svelte to 4.2.19 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-45047 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45047 exists.
Other vulnerabilities in sveltejs svelte
- CVE-2021-29261 Code injection in n/a
- CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation
- CVE-2022-25875 Cross-site Scripting (XSS)
- CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State
- CVE-2026-27901 Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Sources
Also known as GHSA-8266-84wp-wv5c.