{"action":"Upgrade svelte to 3.59.2 or later.","affected":[{"fixed":"3.59.2","introduced":"3.0.0"}],"component":"svelte","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["3.59.2"],"ghsa_id":"GHSA-gw32-9rmw-qwww","id":"tcs_01M5KFSMHX8JSZ5G7MJ5YF5JSE","modified_at":"2026-02-03T03:17:01.517258Z","published_at":"2026-01-16T21:02:56Z","references":["https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww","https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww","https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc","https://github.com/sveltejs/svelte"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gw32-9rmw-qwww","url":"https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww"}],"summary":"svelte is vulnerable to XSS with textarea bind:value"}