CVE-2025-15265: 
JavaScript vulnerability analysis and mitigation

CVE-2025-15265 is a server-side Cross-Site Scripting (XSS) vulnerability in the Svelte JavaScript framework affecting versions 5.46.0 through 5.46.3 (patched in 5.46.4). The flaw exists in the hydratable function used during async hydration with SSR: attacker-controlled keys are embedded into a <script> block in the server-rendered <head> without HTML-safe escaping, allowing injection of arbitrary JavaScript. It was discovered by Fluid Attacks (researcher caverav) and disclosed on January 15, 2026. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Svelte Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In Svelte's server-side renderer (packages/svelte/src/internal/server/renderer.js), the hydratable function serializes its first argument (a key) using JSON.stringify, which does not escape sequences like </script>. This allows an attacker-controlled key to terminate the enclosing <script> block and inject arbitrary JavaScript into the HTML response sent to clients. Exploitation requires: (1) the application has the experimental.async flag enabled, (2) the hydratable function is used, and (3) attacker-controlled input is passed as the key argument. The fix replaces JSON.stringify with devalue.uneval for safe serialization (Svelte Advisory, Fix Commit).

Successful exploitation results in arbitrary JavaScript execution in the browsers of users who receive the maliciously crafted server-rendered HTML. Potential outcomes include session and authentication token theft, DOM defacement, CSRF bypass via injected scripts, and full account takeover depending on the application's cookie and session management strategy. Because the malicious payload is injected server-side and delivered to all clients receiving the affected page, the blast radius can extend to any user visiting the compromised endpoint (Github Advisory, Svelte Advisory).

A proof-of-concept exploit is publicly available via Fluid Attacks' advisory at https://fluidattacks.com/advisories/lydian. Exploitation requires only a single HTTP request if the attacker controls the hydratable key, and no authentication is needed. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.017% (4th percentile), indicating a low current probability of active exploitation (Github Advisory, Fluid Attacks PoC).

1. Identify target: Locate a Svelte application running versions 5.46.0–5.46.3 with the experimental.async flag enabled and using the hydratable function with user-supplied input as the key.
2. Craft malicious key: Construct a string that breaks out of the <script> block, such as </script><script>alert(document.cookie)</script> or a more sophisticated payload for session theft.
3. Deliver payload: Submit the malicious string as the attacker-controlled input that gets passed to the hydratable key parameter (e.g., via a URL parameter, form field, or API input that the application uses as the key).
4. Server renders poisoned HTML: The Svelte SSR engine embeds the unescaped key into the <head> script block using JSON.stringify, producing output like: const h = (window.__svelte ??= {}).h ??= new Map(); h.set(</script><script>alert(document.cookie)</script>, ...).
5. Victim's browser executes payload: Any user who receives the server-rendered HTML page will have the injected JavaScript executed in their browser, enabling session theft, credential harvesting, or further attacks (Svelte Advisory, Fluid Attacks PoC).

• Network: HTTP responses from the Svelte SSR server containing </script> sequences within <script> blocks in the <head> section, particularly adjacent to window.__svelte hydration map initialization code.
• Logs: Server-side access logs showing requests with unusual or encoded strings in parameters that are used as hydratable keys; unexpected characters such as <, >, or /script in key-related query parameters or request bodies.
• File System: No direct file system artifacts expected, as this is a runtime injection vulnerability; however, review server-side templates or components that pass user input to the hydratable function.
• Process/Application Behavior: Client-side reports of unexpected JavaScript execution, pop-ups, or redirects on pages using async hydration; anomalous outbound network requests from users' browsers to attacker-controlled domains following page load (Svelte Advisory).

The primary remediation is to upgrade Svelte to version 5.46.4 or later, which replaces JSON.stringify with devalue.uneval for safe serialization of hydratable keys (Fix Commit, Release 5.46.4). As a temporary workaround, disable the experimental.async flag if it is not required, or ensure that all user-controlled input is sanitized before being passed as a hydratable key. Additionally, implementing a strict Content Security Policy (CSP) can limit the impact of any injected scripts (Github Advisory).

The Svelte team published an official blog post covering CVEs affecting the Svelte ecosystem at https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem, acknowledging the issue and directing users to upgrade. The vulnerability was discussed on Hacker News shortly after disclosure. The fix was credited to researcher caverav (Fluid Attacks) as finder, with Rich-Harris (Svelte core maintainer) as remediation reviewer, reflecting a coordinated disclosure process (Svelte Blog, Github Advisory).