{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-42573","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-04-28T17:26:12.084Z","datePublished":"2026-06-09T16:21:29.313Z","dateUpdated":"2026-07-15T00:57:09.078Z"},"containers":{"cna":{"title":"Svelte: XSS via DOM Clobbering of Internal Framework State","problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N","version":"4.0"}}],"references":[{"name":"https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42"},{"name":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7","tags":["x_refsource_MISC"],"url":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7"}],"affected":[{"vendor":"sveltejs","product":"svelte","versions":[{"version":"< 5.55.7","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-06-09T16:21:29.313Z"},"descriptions":[{"lang":"en","value":"Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7."}],"source":{"advisory":"GHSA-rcqx-6q8c-2c42","discovery":"UNKNOWN"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T18:25:38.450512Z","id":"CVE-2026-42573","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-09T18:25:49.121Z"}},{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"],"defaultStatus":"unaffected","packageName":"rh-podman-desktop.git","product":"Red Hat Build of Podman Desktop","vendor":"Red Hat"}],"datePublic":"2026-06-09T16:21:29.313Z","descriptions":[{"lang":"en","value":"A flaw was found in Svelte, a web framework. An attacker could exploit a DOM clobbering vulnerability, which allows manipulation of the Document Object Model (DOM) to overwrite internal framework state on elements. This could potentially lead to Cross-Site Scripting (XSS) attacks, enabling the attacker to inject malicious scripts into web pages viewed by other users."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-42573"},{"name":"RHBZ#2487093","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487093"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json"}],"timeline":[{"lang":"en","time":"2026-06-09T18:01:50.543Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-09T16:21:29.313Z","value":"Made public."}],"title":"svelte: Svelte: Cross-Site Scripting via DOM Clobbering","x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"},"providerMetadata":{"orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP","dateUpdated":"2026-07-15T00:57:09.078Z"}}]}}