@astrojs/svelte has 1 advisory. Fixed in 9.1.2.

npm

Versions

Red: affected by at least one advisory. White: safe.

9.x
safe 9.1.2
AffectedSafe

Details

Safe
9.1.2
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(1)

Reflected XSS via unescaped slot names in @astrojs/svelte

@astrojs/svelte · 28 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @astrojs/svelte at a version >= 5.7.3 and <= 9.1.1.
  • A page passes request-controlled input (such as a query parameter) as a slot name to a Svelte component.
  • The Svelte component is hydrated with a client: directive.
  • The Svelte component renders the attacker-chosen slot, e.g. a Svelte 5 component that renders snippets by a dynamic name.
Affected
@astrojs/svelte >=5.7.3 <=9.1.1
Fixed in
9.1.2
ID
GHSA-f4j9-crrj-867q
Open the alert