GHSA-crpf-4hrx-3jrpMedium

Svelte SSR attribute spreading includes inherited properties from prototype chain

Published
February 19, 2026
Last Modified
February 23, 2026

🔗 CVE IDs covered (1)

📋 Description

In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.

🎯 Affected products1

  • npm/svelte:<= 5.51.4

🔗 References (5)