Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sveltejs/svelte

              main @ eae50df
            

Fixes

CVEs

CRITICAL

Peak severity

52.9%

Coverage

Highlights

Cross-Site Scripting (XSS): 10 prior fixes. Scrutinize any change in this area.

src/runtime/internal/ssr.ts: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Spread attributes processed during server-side rendering can lead to XSS if event handler attributes (such as onclick or onerror) are not stripped case-insensitively, or if empty-string attribute names are handled unsafely.

Reflected XSS: During hydration and SSR, serialization of state or embedded error messages into script tags or HTML comments can result in XSS if simple JSON serialization or unescaped outputs are used instead of secure escaping primitives.

Cross-Site Scripting (XSS): Legacy and modern SSR utilities can bypass attribute escaping when serializing custom objects that implement their own custom toString() methods, enabling complete HTML entity escaping bypasses.