CVE-2025-15265 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
Attackers can inject arbitrary JavaScript via unescaped keys in Svelte SSR hydration, leading to remote code execution and account compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-15265?
CVE-2025-15265 is a medium-severity cross-site scripting vulnerability in Svelte, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe escaping, allowing </script> to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise. This issue affects Svelte: from 5.46.0 before 5.46.3.
Weakness: CWE-79
Which versions are affected by CVE-2025-15265?
2 open source packages ship an affected version, including svelte. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
svelte npm | From 5.46.0 | 5.46.4 |
svelte npm | From 5.46.0 | 5.46.4 |
Products include Svelte Svelte.
How do I fix CVE-2025-15265?
Upgrade svelte to 5.46.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-15265 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15265 exists.
Other vulnerabilities in Svelte
- CVE-2021-29261 Code injection in n/a
- CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation
- CVE-2024-45047 Potential mXSS vulnerability due to improper HTML escaping in svelte
- CVE-2022-25875 Cross-site Scripting (XSS)
- CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State
Sources
Also known as GHSA-6738-r8g5-qwp3.