Overview
About vulnerability
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using
hydratable(an experimental feature at the time of this report) - you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g.
hydratable('someKey', () => [synchronousValue, promiseValue])
Details
- Affected product:
- astro , language-server , language-tools , svelte , svelte2tsx
- Affected packages:
- svelte2tsx @ 0.5.23 (+12 more)