{"id":"CVE-2026-42573","state":"PUBLISHED","title":"Svelte: XSS via DOM Clobbering of Internal Framework State","description":"Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.","publishedAt":"2026-06-09T16:21:29.313Z","updatedAt":"2026-07-15T00:57:09.078Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["sveltejs svelte"],"affected":[{"vendor":"sveltejs","product":"svelte","versions":[{"version":"< 5.55.7","status":"affected"}]}],"references":["https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42","https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7","https://access.redhat.com/security/cve/CVE-2026-42573","https://bugzilla.redhat.com/show_bug.cgi?id=2487093","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/42xxx/CVE-2026-42573.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-42573","state":"PUBLISHED","datePublished":"2026-06-09T16:21:29.313Z","dateUpdated":"2026-07-15T00:57:09.078Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-28T17:26:12.084Z"},"containers":{"cna":{"title":"Svelte: XSS via DOM Clobbering of Internal Framework State","descriptions":[{"lang":"en","value":"Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7."}],"affected":[{"vendor":"sveltejs","product":"svelte","versions":[{"version":"< 5.55.7","status":"affected"}]}],"references":[{"url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42","name":"https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7","name":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-06-09T16:21:29.313Z"},"source":{"advisory":"GHSA-rcqx-6q8c-2c42","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T18:25:38.450512Z","id":"CVE-2026-42573","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-09T18:25:49.121Z"}},{"title":"svelte: Svelte: Cross-Site Scripting via DOM Clobbering","descriptions":[{"lang":"en","value":"A flaw was found in Svelte, a web framework. An attacker could exploit a DOM clobbering vulnerability, which allows manipulation of the Document Object Model (DOM) to overwrite internal framework state on elements. This could potentially lead to Cross-Site Scripting (XSS) attacks, enabling the attacker to inject malicious scripts into web pages viewed by other users."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"rh-podman-desktop.git","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-42573","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487093","name":"RHBZ#2487093","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:57:09.078Z"},"datePublic":"2026-06-09T16:21:29.313Z","timeline":[{"lang":"en","time":"2026-06-09T18:01:50.543Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-09T16:21:29.313Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}