Vulnerability Details : CVE-2022-25875
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2022-25875
- cpe:2.3:a:svelte:svelte:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-25875
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 37 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-25875
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
Snyk |
CWE ids for CVE-2022-25875
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-25875
-
https://github.com/sveltejs/svelte/pull/7530%23issuecomment-1158575990
Page not found · GitHub · GitHubBroken Link
-
https://github.com/sveltejs/svelte/commit/f8605d6acbf66976da9b4547f76e90e163899907
[fix] harden attribute escaping during ssr (#7530) · sveltejs/svelte@f8605d6 · GitHubExploit;Patch;Third Party Advisory
-
https://snyk.io/vuln/SNYK-JS-SVELTE-2931080
Cross-site Scripting (XSS) in svelte | CVE-2022-25875 | SnykExploit;Patch;Third Party Advisory
Jump to