Post

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

The `svelte` security patches are available in version 5.51.5. All of these had to do with SSR escaping issues. Thankfully, they're all very difficult to exploit in practice. (Most of them would require upstream system compromise along with some level of knowledge of the application's internals).

The `@sveltejs/kit` patches are available in version 2.52.2. Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

The `devalue` patches are available in version `5.6.3`. It's very, very unlikely you're affected, but you should upgrade anyway!

The `@sveltejs/adapter-vercel` patches are available in 6.3.2. If you're on Vercel, you should upgrade. We deployed WAF protections for most exploit patterns, but the only way to immunize yourself to this one is by upgrading or being lucky enough to have an app configuration that prevents it.