GHSA-gw32-9rmw-qwww svelte is vulnerable to XSS with textarea bind:value

Not scored Published 16 Jan 2026

Server-side rendered Svelte components with two-way bound textarea values fail to escape content, allowing attackers to inject malicious scripts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-gw32-9rmw-qwww?

GHSA-gw32-9rmw-qwww is a cross-site scripting vulnerability in svelte, published on 16 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summary

A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.

Details

In SSR, <textarea bind:value={...}> does not have its value escaped when it is rendered into the HTML as <textarea>...</textarea>.

PoC

Put this in a server-side-rendered Svelte component:

&lt;script&gt;
  let value = `test&#39;&#34;&gt;&lt;/textarea&gt;&lt;script` + `&gt;alert(&#39;BIM&#39;);&lt;/sc` + `ript&gt;`;
&lt;/script&gt;

&lt;textarea bind:value /&gt;

Impact

Only affects SSR
Needs a <textarea bind:value> filled by user content via two-way binding

Which versions are affected by GHSA-gw32-9rmw-qwww?

2 open source packages ship an affected version, including svelte.

Package	Affected	Fixed in
`svelte` npm	From `3.0.0`	`3.59.2`
`svelte` npm	From `3.0.0`	`3.59.2`

How do I fix GHSA-gw32-9rmw-qwww?

Upgrade svelte to 3.59.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-gw32-9rmw-qwww being exploited?

There is no known exploitation of GHSA-gw32-9rmw-qwww in the wild and no public exploit code.