Post

Elliott Johnson
@ell.iott.dev

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

Elliott Johnson
@ell.iott.dev

The `svelte` security patches are available in version 5.51.5. All of these had to do with SSR escaping issues. Thankfully, they're all very difficult to exploit in practice. (Most of them would require upstream system compromise along with some level of knowledge of the application's internals).

Elliott Johnson
@ell.iott.dev

The `@sveltejs/kit` patches are available in version 2.52.2. Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

Elliott Johnson
@ell.iott.dev

The `@sveltejs/adapter-vercel` patches are available in 6.3.2. If you're on Vercel, you should upgrade. We deployed WAF protections for most exploit patterns, but the only way to immunize yourself to this one is by upgrading or being lucky enough to have an app configuration that prevents it.

0 reposts2 likes

Elliott Johnson
@ell.iott.dev

Huge thanks to everyone involved, and a special shoutout for the security team at Vercel for working with us to pay our reporters and managing this new bug bounty!