1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (100.0%)
astrojs-svelte
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 1 version
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (1)
Known vulnerabilities affecting astrojs-svelte, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-f4j9-crrj-867q | Low | Astro: Reflected XSS via unescaped slot names in @astrojs/svelte## Summary The `@astrojs/svelte` renderer wraps slotted content passed to Svelte components in an `<astro-slot>` element, and writes the slot name into its `name` attribute without HTML escaping. A slot name containing `"` could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ```astro --- import Tabs from '../components/Tabs.svelte'; const tab = Astro.url.searchParams.get('tab'); --- <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> ``` rendered with a Svelte 5 component that renders its snippets by name: |
| GitHub (opens in a new tab) |
- GHSA-f4j9-crrj-867qLowAstro: Reflected XSS via unescaped slot names in @astrojs/svelte
>= 5.7.3, < 9.1.2
## Summary The `@astrojs/svelte` renderer wraps slotted content passed to Svelte components in an `<astro-slot>` element, and writes the slot name into its `name` attribute without HTML escaping. A slot name containing `"` could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ```astro --- import Tabs from '../components/Tabs.svelte'; const tab = Astro.url.searchParams.get('tab'); --- <Tabs client:load active={tab}><div slot={tab}>…</div></Tabs> ``` rendered with a Svelte 5 component that renders its snippets by name:
CVE: CVE-2026-126362