Svelte versions prior to 5.55.7 contain a flaw that allows an attacker to clobber internal framework state on DOM elements, creating a client‑side XSS vector. By injecting crafted attribute values, malicious code can execute in the victim’s browser, potentially leading to session hijacking, data theft, or further exploitation of web application logic.

The vulnerability affects the Svelte JavaScript framework from the sveltejs organization. Any application built with a Svelte version earlier than 5.55.7 is at risk, including dependencies that transitively bundle older Svelte releases.

The CVSS v3.1 score is 5.3, indicating moderate severity. EPSS information is not currently available, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to visit a page that uses the vulnerable Svelte build; the attacker supplies malicious attribute values that overwrite internal framework state, enabling script execution. Because the flaw is client‑side, it is broadly applicable but does not grant direct access to server‑side resources.