{"id":"CVE-2025-15265","summary":"Svelte 5.46.0  - Hydratable Key Script-Breakout XSS (SSR)","details":"An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a \u003cscript\u003e block without HTML‑safe escaping, allowing \u003c/script\u003e to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise.\nThis issue affects Svelte: from 5.46.0 before 5.46.3.","aliases":["GHSA-6738-r8g5-qwp3"],"modified":"2026-08-12T03:51:40.354810875Z","published":"2026-01-15T19:59:41.683Z","database_specific":{"cna_assigner":"Fluid Attacks","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15265.json"},"references":[{"type":"WEB","url":"https://registry.npmjs.org"},{"type":"ADVISORY","url":"https://fluidattacks.com/advisories/lydian"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15265.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-6738-r8g5-qwp3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15265"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sveltejs/svelte","events":[{"introduced":"435da13fddaf1872a3fb46a7e8a20bb73322148e"},{"fixed":"ed8dcd063625062f03291f2f086fee75e1dc5105"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"5.46.0"},{"fixed":"5.46.3"}]}}],"versions":["svelte@5.46.1","svelte@5.46.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15265.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}