Cross‑site scripting arises when untrusted data is spread onto element attributes during server‑side rendering; the framework mistakenly includes event handler properties, allowing malicious scripts to execute in victims' browsers.

Svelte framework versions earlier than 5.51.5 are vulnerable. The issue manifests in any project that uses server‑side rendering and spreads user‑supplied data into templates, requiring a review of dependencies and code.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity, and an EPSS score of less than 1%, implying a very low probability of exploitation. It is not listed in the KEV catalog, so no active exploitation is reported. An attacker would need to inject data that is rendered on the server; once executed, the injected event handlers could exfiltrate data or hijack user sessions.