Overview
About vulnerability
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using
hydratable(an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.
hydratable('someKey', () => [synchronousValue, promiseValue])
Details
- Affected product:
- astro , language-server , language-tools , svelte , svelte2tsx
- Affected packages:
- svelte @ 1.64.1 (+13 more)