to terminate", "datePublished": "2026-01-15T20:16:03+00:00", "dateModified": "2026-01-23T19:04:53+00:00", "author": { "@type": "Organization", "name": "National Vulnerability Database" }, "publisher": { "@type": "Organization", "name": "CVEInfo.com", "logo": { "@type": "ImageObject", "url": "https://cveinfo.com/logo.png", "width": 600, "height": 60 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://cveinfo.com/detail.php?id=CVE-2025-15265" } }
Back to CVE List

CVE-2025-15265

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score
6.1 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vulnerability Description

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe escaping, allowing </script> to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for session theft and account compromise.
This issue affects Svelte: from 5.46.0 before 5.46.3.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-79
Source
NVD
Vendor
svelte
Product
svelte

External References

Discussion (0)

Add Comment

No comments yet. Be the first!