Summary
svelte vulnerable to Cross-site Scripting
An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.
Details
When using the hydratable function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.
This key is embedded into a <script> block in the server-rendered <head> without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.
Impact
This is a cross-site scripting vulnerability affecting applications that have the experimental.async flag enabled and use hydratable with keys incorporating untrusted user input.
- Impact: Arbitrary JS execution in the client’s browser.
- Exploitability: Remote, single-request if key is attacker-controlled.
- Typical Outcomes:
- Session/token theft
- DOM defacement
- CSRF bypass via injected JS
- Account takeover depending on cookie/session strategy
Affected applications should upgrade to a patched version immediately.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2025-15265? CVE-2025-15265 is a medium-severity cross-site scripting (XSS) vulnerability in svelte (npm), affecting versions >= 5.46.0, <= 5.46.3. It is fixed in 5.46.4. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- Which versions of svelte are affected by CVE-2025-15265? svelte (npm) versions >= 5.46.0, <= 5.46.3 is affected.
- Is there a fix for CVE-2025-15265? Yes. CVE-2025-15265 is fixed in 5.46.4. Upgrade to this version or later.
- Is CVE-2025-15265 exploitable, and should I be worried? Whether CVE-2025-15265 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-15265 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-15265? Upgrade
svelteto 5.46.4 or later.