Svelte’s server‑side rendering logic was previously designed to spread custom attributes onto elements using the syntax <div {...attrs}>. The implementation enumerated all enumerable properties of the provided object, including those inherited from the prototype chain. This unintended inclusion of inherited properties is a manifestation of CWE‑915. If the global Object.prototype had been modified—an event Svelte does not control—the spread operation could inject additional, unintended attributes into the rendered HTML or cause the renderer to throw exceptions. This flaw does not affect client‑side rendering and is limited to environments where SSR is performed.

The vulnerability applies to any deployment of Svelte version 5.51.4 or earlier that performs server‑side rendering. Users must verify the Svelte version by inspecting package.json or running npm list svelte. The affected runtime is Node.js environments that include Svelte SSR.

The flaw carries a CVSS score of 5.3, placing it in the moderate range. The EPSS score is below 1 %, indicating a low likelihood of exploitation at the time of analysis. The issue is not listed in CISA’s KEV catalog. Exploitation would require an attacker to supply a polluted Object.prototype or supply a user‑controlled object that has unexpected inherited properties. Because Svelte’s implementation does not filter or validate the source of attributes, an attacker could cause the SSR pipeline to emit extraneous attributes that may leak data or trigger runtime failures, but the impact remains confined to the generated markup and does not allow execution of arbitrary code.