@ASTROJS/SVELTE · GHSA-f4j9-crrj-867q · Package
FIX → 9.1.2
The @astrojs/svelte renderer writes slot names into an HTML attribute without escaping them, so a crafted slot name can break out and inject HTML. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, but only under specific conditions.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built with Astro that use the @astrojs/svelte integration, pass request-controlled input such as a query parameter as a slot name, hydrate the component with a client:* directive, and render the attacker-chosen slot in a Svelte 5 component. Sites that do not take slot names from requests, or that use only static or non-hydrated components, are not exposed.
Not affected if auth-required, default-config, static-export
Who cares astro, npm, self-hosted, svelte
npm ls @astrojs/svelteclient:* directive{@render snippets[active]?.()}Upgrade to 9.1.2
The @astrojs/svelte renderer wraps slotted content passed to Svelte components in an <astro-slot> element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page.
For example, a page that takes a slot name from the request:
---
import Tabs from '../components/Tabs.svelte';
const tab = Astro.url.searchParams.get('tab');
---
<Tabs client:load active={tab}><div slot={tab}>…</div></Tabs>
rendered with a Svelte 5 component that renders its snippets by name:
<script>
let { active, ...snippets } = $props();
</script>
{@render snippets[active]?.()}
would output a tab value such as x"><img src=x onerror=alert(1)> as live HTML.
Reflected cross-site scripting. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, but only in applications where all of the following are true:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@astrojs/svelte to 9.1.2 or later>= 5.7.3, <= 9.1.1client:* directive. For non-hydrated components the slot wrapper is removed from the output, together with its name attribute.This is the @astrojs/svelte counterpart of GHSA-8hv8-536x-4wqp (CVE-2026-50146), which fixed the same issue in astro core. The same unescaped value was also used when hydrating the component in the browser.
@astrojs/svelte >= 5.7.3, <= 9.1.1.
Fixed in @astrojs/svelte 9.1.2. Slot names are now HTML-escaped in the server renderer and in the client-side hydration code.
Upgrade to @astrojs/svelte 9.1.2 or later. Before upgrading, do not use request-controlled input as a slot name, or map it to a fixed set of known slot names before passing it to a component.
Reported by @manus-pi.