An open index of dependabot pull requests across open source projects.

svelte

Ecosystem:
npm
Package URL:
pkg:npm/svelte
Total PRs:
22,340 Dependabot PRs
Latest PR:
2 days ago
Unique Repositories:
4,201 repositories
Unique Repos (30 days):
210 repositories
Security Advisories
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
GHSA-m56q-vw4c-c2cp CVE-2026-27122 MODERATE published 4 months ago • updated about 2 months ago
When using `<svelte:element this={tag}>` in server-side rendering, the provided tag name is not validated or sanitized before being emitted into th...
Svelte affected by XSS in SSR `<option>` element
GHSA-h7h7-mm68-gmrc CVE-2026-27119 MODERATE published 4 months ago • updated about 2 months ago
In certain circumstances, the server-side rendering output of an `<option>` element does not properly escape its content, potentially allowing HTML...
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
GHSA-f3cj-j4f6-wq85 MODERATE published about 1 month ago • updated about 1 month ago
Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following ...
Svelte: ReDoS in `<svelte:element>` Tag Validation
GHSA-9rmh-mm8f-r9h6 CVE-2026-42567 MODERATE published about 1 month ago • updated 6 days ago
An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerabl...
svelte vulnerable to Cross-site Scripting
GHSA-6738-r8g5-qwp3 CVE-2025-15265 MODERATE published 5 months ago • updated 5 days ago
## Summary An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of `hydratable` keys. If these keys incorporate untrust...
Recent PRs (filtered by: Patch PRs )
Package Details
Name: svelte
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/svelte
JSON API: View JSON
Security Advisories

14

Active advisories
HIGH 1
MODERATE 13
View All npm Advisories
Package Information
Description:

Cybernetically enhanced web apps

Repository: https://github.com/sveltejs/svelte
Homepage: https://svelte.dev
Latest Release: 5.2.11
over 1 year ago
Dependent Repos: 56,439
Dependent Packages: 8,815
Downloads: 7,230,385
Ranking: Top 0.1279% by dependent repos Top 0.1344% by downloads Top 0.0104% by dependent pkgs
PR Status
Open 9,426 (42.2%)
Merged 3,038 (13.6%)
Closed 8,120 (36.3%)
PR Types
Major 2,059 (9.2%)
Minor 10,611 (47.5%)
Patch 7,903 (35.4%)
Removal 7 (0.0%)