{"action":"Upgrade svelte to 5.55.7 or later.","affected":[{"fixed":"5.55.7","introduced":"5.46.0"}],"component":"svelte","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.55.7"],"ghsa_id":"GHSA-f3cj-j4f6-wq85","id":"tcs_01M5KFMA6HZFP6ZFEBX4J0QGX6","modified_at":"2026-05-14T20:49:54.154680Z","published_at":"2026-05-14T20:30:09Z","references":["https://osv.dev/vulnerability/GHSA-f3cj-j4f6-wq85","https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85","https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4","https://github.com/sveltejs/svelte","http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f3cj-j4f6-wq85","url":"https://osv.dev/vulnerability/GHSA-f3cj-j4f6-wq85"}],"summary":"Svelte: SSR XSS via Insecure Promise Serialization in hydratable"}