CLSA-2026-1784769620 TuxCare security update for svelte (2 CVEs)

TuxCare rebuilt svelte to address 2 CVEs. Fixed in 0.3.0-tuxcare.2...

CLSA-2026-1776213244 TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 1.64.1-tuxcare.1...

CLSA-2026-1775953999 TuxCare security update for svelte (4 CVEs)

TuxCare rebuilt svelte to address 4 CVEs. Fixed in 4.2.20-tuxcare.1...

GHSA-QGVG-PR8V-6RR3 Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError...

CVE-2025-15265 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for...