{"id":"CVE-2025-15265","aliases":["GHSA-6738-r8g5-qwp3"],"url":"https://o3.security/vulnerability/CVE-2025-15265","summary":"Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)","details":"## Summary\n\nAn XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of `hydratable` keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.\n\n## Details\n\nWhen using the [`hydratable`](https://svelte.dev/docs/svelte/hydratable) function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.\n\nThis key is embedded into a `