GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea…

\n\n

\n```\n\n### Impact\n\n- Only a","datePublished":"2026-01-16T21:02:56Z","dateModified":"2026-02-03T03:17:01.517258Z","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"svelte","applicationCategory":"npm","softwareVersion":"3.59.2"}],"citation":[{"@type":"WebPage","url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww"},{"@type":"WebPage","url":"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc"}]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"Dataset","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#record","name":"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value","description":"### Summary\n\nA server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.\n\n### Details\n\nIn SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...

`.\n\n### PoC\n\nPut this in a server-side-rendered Svelte component:\n\n```\n\n\n

\n```\n\n### Impact\n\n- Only a","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww","identifier":"GHSA-gw32-9rmw-qwww","datePublished":"2026-01-16T21:02:56Z","dateModified":"2026-02-03T03:17:01.517258Z","inLanguage":"en","keywords":["GHSA-gw32-9rmw-qwww","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"HowTo","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#howtofix","name":"How to fix GHSA-gw32-9rmw-qwww","description":"Step-by-step remediation for GHSA-gw32-9rmw-qwww.","step":[{"@type":"HowToStep","position":1,"name":"Update svelte to 3.59.2 or later","text":"Upgrade svelte to 3.59.2 or newer with your package manager — the version where GHSA-gw32-9rmw-qwww is patched.","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-1"},{"@type":"HowToStep","position":2,"name":"Check transitive dependencies","text":"Verify no transitive (indirect) dependency still pins the vulnerable version of svelte.","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-2"},{"@type":"HowToStep","position":3,"name":"Verify reachability with Impact-Aware SCA","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-3"}]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"FAQPage","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#faq","mainEntity":[{"@type":"Question","name":"What is GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"### Summary\n\nA server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.\n\n### Details\n\nIn SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...

`.\n\n### PoC\n\nPut this in a server-side-rendered Svelte component:\n\n```\n\n\n

\n```\n\n### Impact\n\n- Only affects SSR\n- Needs a `<textarea bind:value>` filled by user content via two-way binding"}},{"@type":"Question","name":"How severe is GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure."}},{"@type":"Question","name":"Which packages are affected by GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm."}},{"@type":"Question","name":"How do I fix GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match."}},{"@type":"Question","name":"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands."}},{"@type":"Question","name":"How does O3 Security protect against GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"O3 pinpoints whether GHSA-gw32-9rmw-qwww is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed."}},{"@type":"Question","name":"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"When was GHSA-gw32-9rmw-qwww published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}</script><div class="min-h-screen bg-surface text-content selection:bg-[#5136d2]/30 selection:text-content"><header class="fixed inset-x-0 top-0 z-40"><div class="relative z-40 flex w-full items-center justify-center px-4 py-1 text-xs md:text-sm overflow-hidden bg-[#111111]" style="height:0px"><div class="py-2 w-full flex items-center justify-center"><div class="flex items-center justify-center gap-3 text-[11px] md:text-xs font-medium text-white pr-8"><span>Your RSA-2048 keys break in 2030. Find every one of them before attackers do.</span><a class="hidden md:flex items-center gap-1 text-white font-bold hover:underline decoration-white/30 underline-offset-2" href="/cryptographic-bill-of-materials">See CBOMkit <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right size-3" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a></div></div><button class="absolute top-1/2 right-3 -translate-y-1/2 cursor-pointer text-white/60 hover:text-white transition-colors" aria-label="Dismiss banner"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-x size-3.5" aria-hidden="true"><path d="M18 6 6 18"></path><path d="m6 6 12 12"></path></svg></button><div class="absolute bottom-0 left-0 right-0 h-px bg-gradient-to-r from-o3-signal-cyan via-o3-violet to-o3-lavender opacity-80"></div></div><nav class="relative w-full transition-colors duration-300 bg-surface-overlay border-b border-transparent"><div class="mx-auto w-full max-w-[1440px] px-4 sm:px-6 lg:px-8"><div class="flex items-center justify-between h-16"><a class="flex items-center shrink-0 z-20 px-2" href="/"><img src="/images/O3-text-white.svg" alt="O3 Security" class="h-5 md:h-6 w-auto object-contain"/></a><nav aria-label="Main" data-orientation="horizontal" dir="ltr" class="z-10 max-w-max items-center hidden lg:flex flex-1 justify-center px-4"><div style="position:relative"><ul data-orientation="horizontal" class="group flex flex-1 list-none items-center justify-center space-x-1" dir="ltr"><li><button id="radix-_R_2cpbsnpfdb_-trigger-radix-_R_2qcpbsnpfdb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_2cpbsnpfdb_-content-radix-_R_2qcpbsnpfdb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">Product <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><button id="radix-_R_2cpbsnpfdb_-trigger-radix-_R_4qcpbsnpfdb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_2cpbsnpfdb_-content-radix-_R_4qcpbsnpfdb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">BOM Suite <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><button id="radix-_R_2cpbsnpfdb_-trigger-radix-_R_6qcpbsnpfdb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_2cpbsnpfdb_-content-radix-_R_6qcpbsnpfdb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">Compliance <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><a href="/academy" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content" data-radix-collection-item="">Academy</a></li></ul></div><div class="absolute left-1/2 top-full flex -translate-x-1/2 justify-center z-50"></div></nav><div class="hidden lg:flex items-center gap-3"><a class="flex items-center px-3.5 h-[34px] rounded-lg bg-red-800 hover:bg-red-900 border border-red-700/20 text-white text-xs font-medium tracking-wide active:scale-[0.98] transition-all" href="/supplychain-under-attack-help">Under attack?</a><a class="flex items-center justify-center px-4 h-[34px] bg-primary text-primary-foreground rounded-lg font-semibold text-xs hover:bg-primary/90 transition-colors duration-300 hover:scale-[1.02] active:scale-95" href="/book-demo">Book a Demo</a></div><div class="lg:hidden flex items-center gap-2"><button type="button" aria-label="Open menu" class="flex items-center justify-center size-9 rounded-md border border-line text-content hover:bg-content/[0.05] transition-colors"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-menu size-5" aria-hidden="true"><path d="M4 5h16"></path><path d="M4 12h16"></path><path d="M4 19h16"></path></svg></button></div></div></div></nav></header><div class="relative z-10 pt-[88px]"><div class="absolute inset-0 opacity-[0.015] pointer-events-none bg-[url('/noise.svg')]"></div><main class="relative max-w-[1160px] mx-auto px-4 sm:px-6 py-8 lg:py-12"><nav class="flex items-center gap-1.5 text-[12px] text-content-faint mb-8"><a class="hover:text-content-muted transition-colors" href="/">Home</a><span class="text-line-strong">/</span><a class="hover:text-content-muted transition-colors" href="/vulnerability">Vulnerabilities</a><span class="text-line-strong">/</span><span class="font-mono text-content-muted">GHSA-gw32-9rmw-qwww</span></nav><div class="flex flex-col xl:flex-row gap-7"><div class="flex-1 min-w-0 space-y-5"><div class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="p-6 md:p-8 pb-6"><div class="flex flex-wrap gap-1.5 mb-3"><span class="inline-flex items-center gap-1.5 text-[11px] px-2.5 py-1 rounded-full bg-line border border-line-strong text-content-subtle font-medium"><span class="text-base leading-none">📦</span> npm</span></div><div class="flex flex-wrap items-center gap-3 mb-4"><h1 class="text-[28px] sm:text-[36px] font-bold font-mono tracking-tight text-content leading-none">GHSA-gw32-9rmw-qwww</h1><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button></div><p class="vuln-summary text-[15px] text-content-muted leading-[1.7] max-w-2xl mb-0">svelte is vulnerable to XSS with textarea bind:value</p></div><div class="mt-6 border-t border-line grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-5 divide-x divide-line"><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-calendar" aria-hidden="true"><path d="M8 2v4"></path><path d="M16 2v4"></path><rect width="18" height="18" x="3" y="4" rx="2"></rect><path d="M3 10h18"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Published</span></div><div class="text-[14px] font-semibold text-content">Jan 16, 2026</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-refresh-cw" aria-hidden="true"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"></path><path d="M21 3v5h-5"></path><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"></path><path d="M8 16H3v5"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Updated</span></div><div class="text-[14px] font-semibold text-content">Feb 3, 2026</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-package" aria-hidden="true"><path d="M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z"></path><path d="M12 22V12"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><path d="m7.5 4.27 9 5.15"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Affected</span></div><div class="text-[14px] font-semibold text-content">1 pkg</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check text-content-faint" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Patched</span></div><div class="text-[14px] font-semibold text-content">1 / 1</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-flame-kindling text-content-faint" aria-hidden="true"><path d="M12 2c1 3 2.5 3.5 3.5 4.5A5 5 0 0 1 17 10a5 5 0 1 1-10 0c0-.3 0-.6.1-.9a2 2 0 1 0 3.3-2C8 4.5 11 2 12 2Z"></path><path d="m5 22 14-4"></path><path d="m5 18 14 4"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Exploits</span></div><div class="text-[14px] font-semibold text-content">None indexed</div></div></div></div><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center justify-between px-5 py-3.5 border-b border-line"><div class="flex items-center gap-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-trending-up text-[#5136d2]" aria-hidden="true"><path d="M16 7h6v6"></path><path d="m22 7-8.5 8.5-5-5L2 17"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Blast Radius</h2></div><span class="text-[11px] text-content-faint">1 pkg affected</span></div><div class="p-5"><p class="text-[12px] text-content-faint mb-4 leading-relaxed">Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.</p><div class="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-3"><div class="flex flex-col gap-2 px-4 py-3 rounded-xl border border-line bg-surface"><div class="flex items-center justify-between gap-2"><code class="text-[12px] font-mono text-content truncate">svelte</code><span class="shrink-0 text-[10px] font-semibold px-1.5 py-0.5 rounded border bg-line border-line-strong text-content-subtle">npm</span></div><div><span class="text-[24px] font-bold tabular-nums text-content leading-none">4.8M</span><span class="text-[11px] text-content-faint ml-1.5">downloads / week</span></div><div class="h-1.5 rounded-full bg-line overflow-hidden"><div class="h-full rounded-full bg-[#5136d2] transition-all" style="width:100%"></div></div></div></div></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center gap-2.5 px-5 py-3.5 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield text-[#5136d2]" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Description</h2></div><div class="px-5 py-5"><h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Summary</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">A server-side rendered <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea></code> with two-way bound value does not have its value correctly escaped in the rendered HTML.</p>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Details</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">In SSR, <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea bind:value={...}></code> does not have its value escaped when it is rendered into the HTML as <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea>...</textarea></code>.</p>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">PoC</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">Put this in a server-side-rendered Svelte component:</p>
<pre class="my-3 rounded-xl border border-line bg-surface overflow-x-auto"><code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />
</code></pre>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Impact</h4>
<ul class="list-disc list-inside space-y-1 mb-3 pl-1 text-[14px] text-content-muted">
<li class="leading-[1.7] marker:text-content-faint">Only affects SSR</li>
<li class="leading-[1.7] marker:text-content-faint">Needs a <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea bind:value></code> filled by user content via two-way binding</li>
</ul></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center justify-between px-5 py-3.5 border-b border-line"><div class="flex items-center gap-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-package text-[#5136d2]" aria-hidden="true"><path d="M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z"></path><path d="M12 22V12"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><path d="m7.5 4.27 9 5.15"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Affected Packages</h2></div><div class="flex items-center gap-3 text-[12px]"><span class="text-content-faint">1 total</span><span class="flex items-center gap-1 text-green-600 dark:text-green-400"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg> 1 fixed</span></div></div><div class="p-4"><div><div class="rounded-xl border border-line overflow-hidden"><table class="w-full text-sm"><thead><tr class="bg-surface-raised border-b border-line"><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Ecosystem</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Package</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Vulnerable range</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Fix</th></tr></thead><tbody class="divide-y divide-line"><tr class="bg-surface hover:bg-surface-raised transition-colors group"><td class="px-4 py-3"><span class="flex items-center gap-2 text-content-muted text-[13px]"><span class="text-base leading-none">📦</span>npm</span></td><td class="px-4 py-3"><span class="flex items-center gap-2"><code class="text-[13px] text-content font-mono">svelte</code><span class="opacity-0 group-hover:opacity-100 transition-opacity"><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button></span></span></td><td class="px-4 py-3 font-mono text-[12px]"><span class="text-orange-500 dark:text-orange-400">≥ 3.0.0</span><span class="text-content-faint mx-1">&&</span><span class="text-content-faint">< 3.59.2</span></td><td class="px-4 py-3 text-[12px]"><span class="inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full bg-line border border-line-strong text-content-subtle font-mono text-[11px]"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg>3.59.2</span></td></tr></tbody></table></div></div></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden" id="mitigation"><div class="px-5 py-4 border-b border-line flex items-center justify-between gap-2"><h2 class="text-[12px] font-semibold text-content">Detection & mitigation playbook</h2><span class="text-[10px] font-medium text-content-subtle px-2 py-0.5 rounded-full border border-line">Open-source dependency</span></div><ol class="p-5 pt-4"><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-search" aria-hidden="true"><path d="m21 21-4.34-4.34"></path><circle cx="11" cy="11" r="8"></circle></svg></span><span class="w-px flex-1 my-1 bg-line" aria-hidden="true"></span></div><div class="flex-1 pb-5"><h3 class="text-[13px] font-semibold mb-1 text-content">Detect</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.</p></div></li><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-refresh-cw" aria-hidden="true"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"></path><path d="M21 3v5h-5"></path><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"></path><path d="M8 16H3v5"></path></svg></span><span class="w-px flex-1 my-1 bg-line" aria-hidden="true"></span></div><div class="flex-1 pb-5"><h3 class="text-[13px] font-semibold mb-1 text-content">Fix</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.</p></div></li><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-triangle-alert" aria-hidden="true"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"></path><path d="M12 9v4"></path><path d="M12 17h.01"></path></svg></span><span class="w-px flex-1 my-1 bg-line" aria-hidden="true"></span></div><div class="flex-1 pb-5"><h3 class="text-[13px] font-semibold mb-1 text-content">Workarounds</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.</p></div></li><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-[#5136d2] text-white"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-zap" aria-hidden="true"><path d="M4 14a1 1 0 0 1-.78-1.63l9.9-10.2a.5.5 0 0 1 .86.46l-1.92 6.02A1 1 0 0 0 13 10h7a1 1 0 0 1 .78 1.63l-9.9 10.2a.5.5 0 0 1-.86-.46l1.92-6.02A1 1 0 0 0 11 14z"></path></svg></span></div><div class="flex-1 "><h3 class="text-[13px] font-semibold mb-1 text-[#6b54e6]">How O3 protects you</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">O3 pinpoints whether GHSA-gw32-9rmw-qwww is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.</p></div></li></ol><p class="px-5 pb-4 text-[11px] text-content-faint leading-relaxed border-t border-line/60 pt-3 mx-0">Tailored to GHSA-gw32-9rmw-qwww. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.</p></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center gap-2.5 px-5 py-3.5 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-trending-up text-[#5136d2]" aria-hidden="true"><path d="M16 7h6v6"></path><path d="m22 7-8.5 8.5-5-5L2 17"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Frequently Asked Questions</h2></div><div class="p-4"><div class="divide-y divide-line rounded-xl border border-line overflow-hidden"><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">What is GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-up" aria-hidden="true"><path d="m18 15-6-6-6 6"></path></svg></span></button><div class="px-5 pb-5 pt-2 text-content-muted text-[14px] leading-relaxed border-t border-line">### Summary

A server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.

### Details

In SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...</textarea>`.

### PoC

Put this in a server-side-rendered Svelte component:

```
<script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />
```

### Impact

- Only affects SSR
- Needs a `<textarea bind:value>` filled by user content via two-way binding</div></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How severe is GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">Which packages are affected by GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I fix GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How does O3 Security protect against GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">Is GHSA-gw32-9rmw-qwww actively exploited in the wild?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">When was GHSA-gw32-9rmw-qwww published, and has it been updated?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div></div></div></section><section class="relative rounded-2xl overflow-hidden border border-[#5136d2]/30 bg-surface-raised"><div class="absolute inset-0 bg-gradient-to-br from-[#5136d2]/[0.07] to-transparent pointer-events-none"></div><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/40 to-transparent"></div><div class="relative p-6 md:p-8"><div class="flex flex-col md:flex-row md:items-center gap-6"><div class="flex-1"><div class="text-[11px] font-bold uppercase tracking-[0.15em] text-[#a78bfa] mb-3">O3 Security · Impact-Aware SCA</div><h3 class="text-[19px] font-semibold text-content mb-2">Is <span class="font-mono text-[#5136d2]">GHSA-gw32-9rmw-qwww</span> in your dependencies?</h3><p class="text-[14px] text-content-muted leading-relaxed max-w-lg">O3 detects GHSA-gw32-9rmw-qwww across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is <em>actually reachable</em> — not just present. No false positives.</p></div><div class="flex flex-col gap-2.5 shrink-0"><a class="inline-flex items-center justify-center gap-2 px-5 py-2.5 rounded-xl bg-[#5136d2] hover:bg-[#4429bc] text-white text-[13px] font-semibold transition-all hover:scale-[1.02] active:scale-95 whitespace-nowrap" href="/book-demo">Scan my dependencies <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="inline-flex items-center justify-center gap-2 px-5 py-2.5 rounded-xl border border-line-strong text-content-muted hover:text-content text-[13px] font-medium transition-all hover:bg-content/[0.06] hover:scale-[1.02] active:scale-95 whitespace-nowrap" href="/impact-aware-sca">How O3 SCA works</a></div></div></div></section></div><aside class="w-full xl:w-[280px] shrink-0 space-y-4"><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center gap-2 px-4 py-3 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-zap text-[#5136d2]" aria-hidden="true"><path d="M4 14a1 1 0 0 1-.78-1.63l9.9-10.2a.5.5 0 0 1 .86.46l-1.92 6.02A1 1 0 0 0 13 10h7a1 1 0 0 1 .78 1.63l-9.9 10.2a.5.5 0 0 1-.86-.46l1.92-6.02A1 1 0 0 0 11 14z"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Weaponization</span></div><div class="p-4 space-y-2.5"><p class="text-[11px] text-content-faint">No known public exploit tooling found.</p><a href="https://github.com/projectdiscovery/nuclei-templates" target="_blank" rel="noopener noreferrer" class="flex items-center justify-between gap-2 group"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-search text-content-faint shrink-0" aria-hidden="true"><path d="m21 21-4.34-4.34"></path><circle cx="11" cy="11" r="8"></circle></svg><span class="text-[12px] text-content-muted">Nuclei template</span></div><span class="text-[10px] text-content-faint">Not found</span></a><a href="https://github.com/search?q=GHSA-gw32-9rmw-qwww+repo%3Arapid7%2Fmetasploit-framework&type=code" target="_blank" rel="noopener noreferrer" class="flex items-center justify-between gap-2 group"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bug text-content-faint shrink-0" aria-hidden="true"><path d="M12 20v-9"></path><path d="M14 7a4 4 0 0 1 4 4v3a6 6 0 0 1-12 0v-3a4 4 0 0 1 4-4z"></path><path d="M14.12 3.88 16 2"></path><path d="M21 21a4 4 0 0 0-3.81-4"></path><path d="M21 5a4 4 0 0 1-3.55 3.97"></path><path d="M22 13h-4"></path><path d="M3 21a4 4 0 0 1 3.81-4"></path><path d="M3 5a4 4 0 0 0 3.55 3.97"></path><path d="M6 13H2"></path><path d="m8 2 1.88 1.88"></path><path d="M9 7.13V6a3 3 0 1 1 6 0v1.13"></path></svg><span class="text-[12px] text-content-muted">Metasploit module</span></div><span class="text-[10px] text-content-faint">Not found</span></a></div></div><div class="rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield text-[#5136d2]" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">OpenSSF Scorecard</span></div><a href="https://securityscorecards.dev/#/projects/github.com/sveltejs/svelte" target="_blank" rel="noopener noreferrer" class="text-[10px] text-content-faint hover:text-content-subtle transition-colors">View full</a></div><div class="p-4 space-y-3"><div class="flex items-center justify-between"><div><div class="text-[11px] text-content-faint mb-0.5">Package health score</div><div class="text-[11px] font-mono text-content-subtle truncate">svelte</div></div><span class="text-[22px] font-bold tabular-nums px-3 py-1.5 rounded-xl border bg-line border-line-strong text-amber-500">6.5<span class="text-[13px] font-normal opacity-60">/10</span></span></div><div class="h-1.5 rounded-full bg-line overflow-hidden"><div class="h-full rounded-full transition-all bg-amber-500" style="width:65%"></div></div><div class="space-y-1.5 pt-1"><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Code-Review</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-green-500">9/10</span></div><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Maintained</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-green-500">10/10</span></div><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Branch-Protection</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-content-faint">N/A</span></div></div><div class="text-[10px] text-content-faint pt-1">Assessed Jun 15, 2026</div></div></div><div class="rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="flex items-center gap-2 px-4 py-3 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-clock text-[#5136d2]" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 6v6l4 2"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Timeline</span></div><div class="px-4 py-5 space-y-0"><div class="flex gap-3"><div class="flex flex-col items-center shrink-0" style="width:16px"><div class="w-3.5 h-3.5 rounded-full shrink-0 mt-0.5 ring-2 ring-surface-raised bg-[#5136d2]" style="box-shadow:0 0 8px #5136d288"></div><div class="w-px flex-1 mt-1" style="background:linear-gradient(to bottom, rgba(81,54,210,0.25), rgba(81,54,210,0.05));min-height:28px"></div></div><div class="pb-4  min-w-0"><div class="text-[10px] text-content-faint uppercase tracking-wider font-semibold leading-none mb-1">Disclosed</div><div class="text-[13px] font-medium text-content-muted">Jan 16, 2026</div></div></div><div class="flex gap-3"><div class="flex flex-col items-center shrink-0" style="width:16px"><div class="w-3.5 h-3.5 rounded-full shrink-0 mt-0.5 ring-2 ring-surface-raised bg-content-faint" style="box-shadow:none"></div></div><div class="pb-4 pb-0 min-w-0"><div class="text-[10px] text-content-faint uppercase tracking-wider font-semibold leading-none mb-1">Last updated</div><div class="text-[13px] font-medium text-content-muted">Feb 3, 2026</div></div></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-tag text-[#5136d2]" aria-hidden="true"><path d="M12.586 2.586A2 2 0 0 0 11.172 2H4a2 2 0 0 0-2 2v7.172a2 2 0 0 0 .586 1.414l8.704 8.704a2.426 2.426 0 0 0 3.42 0l6.58-6.58a2.426 2.426 0 0 0 0-3.42z"></path><circle cx="7.5" cy="7.5" r=".5" fill="currentColor"></circle></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Identifiers</span></div></div><div class="p-4"><div class="space-y-2"><div class="flex items-center justify-between gap-2"><code class="text-[12px] font-mono text-content-muted">GHSA-gw32-9rmw-qwww</code><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button></div></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link text-[#5136d2]" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">References</span></div><span class="text-[11px] text-content-faint">3</span></div><div class=""><div class="overflow-y-auto max-h-72 refs-scroll space-y-0.5 py-2"><a href="https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Web</span><span class="text-[12px] truncate flex-1">github.com</span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a><a href="https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Web</span><span class="text-[12px] truncate flex-1">github.com</span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a><a href="https://github.com/sveltejs/svelte" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Package</span><span class="text-[12px] truncate flex-1">github.com</span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a></div></div></div><p class="text-[11px] text-content-faint px-1 leading-relaxed">Data from <a href="https://osv.dev" target="_blank" rel="noopener noreferrer" class="underline hover:text-content-subtle transition-colors">OSV.dev</a>, enriched by O3 Security. Refreshed hourly.</p></aside></div></main></div><footer class="w-full bg-surface"><div class="max-w-[1400px] mx-auto px-6 lg:px-10"><div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-6 gap-x-6 gap-y-10 py-14 border-b border-line"><nav aria-label="Develop"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Develop</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/developer-security">Developer Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/coding-agents">Coding Agents</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/ai-threat-model">AI Threat Model</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/agentic-sast">Agentic SAST</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/impact-aware-sca">Impact-Aware SCA</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/secret-scanner">Secret Scanner</a></li></ul></nav><nav aria-label="Build"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Build</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/github-actions">GitHub Actions</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/jenkins-security">Jenkins Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/workload-security">Workload Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/malware-detection">Malware Detection</a></li></ul></nav><nav aria-label="Ship"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Ship</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/shift-left-pentest">Shift-left PenTest</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/image-scanning">Image Scanning</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/iac-scanning">IaC Scanning</a></li></ul></nav><nav aria-label="Run"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Run</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/agentic-dast">Agentic DAST</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/kubernetes-security">Kubernetes Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/egress-monitor">Egress Monitor</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/vulnerability">Vulnerability Database</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/malware-database">Malware Database</a></li></ul></nav><nav aria-label="Compliance"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5"><a class="hover:text-content-muted transition-colors" href="/compliance">Compliance</a></h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance">All frameworks</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/eu-cyber-resilience-act-cra-sbom-compliance">EU Cyber Resilience Act</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/cert-in-sbom-cbom-qbom-aibom-hbom-guidelines">CERT-In SBOM Guidelines</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/sebi-cscrf-sbom-compliance-india">SEBI CSCRF</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/executive-order-14028-nist-ssdf-attestation">EO 14028 + NIST SSDF</a></li></ul></nav><nav aria-label="Company"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Company</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/contact-us">Contact Us</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/blog">Blog</a></li></ul></nav></div><div class="flex flex-col md:flex-row md:items-center gap-8 py-10 border-b border-line"><div class="flex flex-col gap-5 md:w-[220px] shrink-0"><a class="inline-flex items-center" href="/"><img src="/images/O3-text-white.svg" alt="O3 Security" class="h-6 w-auto object-contain"/></a><ul aria-label="Social media" class="flex items-center gap-4"><li><a target="_blank" rel="noopener noreferrer" aria-label="Twitter / X" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://twitter.com/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="YouTube" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://youtube.com/@o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="LinkedIn" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://linkedin.com/company/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85 3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.062 2.062 0 01-2.063-2.065 2.063 2.063 0 112.063 2.065zm1.782 13.019H3.555V9h3.564v11.452zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0h.003z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="GitHub" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://github.com/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.4 3-.405 1.02.005 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"></path></svg></a></li></ul></div><div class="hidden md:block w-px self-stretch bg-line mx-4"></div><div class="flex-1 flex items-center justify-between gap-6"><div class="flex items-center gap-6"><img src="/images/soc-2.svg" alt="SOC 2 Type II" title="SOC 2 Type II" class="h-16 w-auto object-contain opacity-70 hover:opacity-100 transition-opacity"/><img src="/images/iso-27001.svg" alt="ISO 27001" title="ISO 27001" class="h-16 w-auto object-contain opacity-70 hover:opacity-100 transition-opacity"/></div><div class="flex flex-wrap items-center justify-end gap-x-3 gap-y-1 text-content-subtle text-[13px]"><a class="hover:text-content transition-colors" href="/privacy">Privacy Notice</a><span class="text-content-faint">•</span><a class="hover:text-content transition-colors" href="/terms">Terms of use</a></div></div></div><div class="py-6 border-t border-line"><div class="text-content-subtle text-[13px]"><span>© 2026 O3 Security Inc.</span><span class="ml-1 text-content-faint">All rights reserved.</span></div></div></div></footer></div><script src="/_next/static/chunks/0mn8b9_.ywjoi.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[865150,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"THEME_NO_FLASH_SCRIPT\"]\n3:I[969471,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"\"]\na:I[13796,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\",1]\nd:I[865150,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"ThemeProvider\"]\ne:I[911440,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\nf:I[356496,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n10:I[350094,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"NotFoundCanvas\"]\n11:I[374603,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"\"]\n12:I[793739,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"default\"]\n13:I[843999,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n14:I[248012,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"DeferredAnalytics\"]\n16:I[66352,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"OutletBoundary\"]\n17:\"$Sreact.suspense\"\n1a:I[66352,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"ViewportBoundary\"]\n1c:I[66352,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"MetadataBoundary\"]\n:HL[\"/_next/static/chunks/0llf70t.ingt3.css\",\"style\"]\n:HL[\"/_next/static/chunks/0ntsw_cpfvn8d.css\",\"style\"]\n:HL[\"/_next/static/media/47fe1b7cd6e6ed85-s.p.0~mcdl10zdfb3.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/797e433ab948586e-s.p.08e28id.o-okb.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/829ba4228c966254-s.p.0ub.k0om~_-xi.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/8e6fa89aa22d24ec-s.p.0uvzar8hswo3p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/a218039a3287bcfd-s.p.17-1enzs_j91b.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/c875c6f5d3e977ac-s.p.0g_ng0t~d_b9n.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/e2334d715941921e-s.p.12skym0rqknxy.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"c\":[\"\",\"vulnerability\",\"GHSA-gw32-9rmw-qwww\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"vulnerability\",{\"children\":[[\"cve\",\"GHSA-gw32-9rmw-qwww\",\"d\",null],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",16],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0llf70t.ingt3.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0ntsw_cpfvn8d.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/0quebjc6y~.bo.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/0duoam7uxl~1r.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"className\":\"h-full antialiased\",\"suppressHydrationWarning\":true,\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$2\"}}],[\"$\",\"link\",null,{\"rel\":\"icon\",\"type\":\"image/png\",\"href\":\"/favicon-96x96.png\",\"sizes\":\"96x96\"}],[\"$\",\"link\",null,{\"rel\":\"icon\",\"type\":\"image/svg+xml\",\"href\":\"/favicon.svg\"}],[\"$\",\"link\",null,{\"rel\":\"shortcut icon\",\"href\":\"/favicon.ico\"}],[\"$\",\"link\",null,{\"rel\":\"apple-touch-icon\",\"sizes\":\"180x180\",\"href\":\"/apple-touch-icon.png\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"application/rss+xml\",\"title\":\"O3 Security — Blog\",\"href\":\"/feed.xml\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"LLM Context (llms.txt)\",\"href\":\"/llms.txt\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"LLM Context — full (llms-full.txt)\",\"href\":\"/llms-full.txt\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"AI Interaction Guidance (ai.txt)\",\"href\":\"/ai.txt\"}],[\"$\",\"meta\",null,{\"name\":\"apple-mobile-web-app-title\",\"content\":\"O3 Security\"}],[\"$\",\"$L3\",null,{\"id\":\"ms-clarity\",\"strategy\":\"lazyOnload\",\"children\":\"(function(c,l,a,r,i,t,y){\\n              c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};\\n              t=l.createElement(r);t.async=1;t.src=\\\"https://www.clarity.ms/tag/\\\"+i;\\n              y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);\\n          })(window, document, \\\"clarity\\\", \\\"script\\\", \\\"x0c1wkg19t\\\");\"}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"Organization\\\",\\\"@id\\\":\\\"https://o3.security/#organization\\\",\\\"name\\\":\\\"O3 Security\\\",\\\"legalName\\\":\\\"O3 Security Inc.\\\",\\\"url\\\":\\\"https://o3.security\\\",\\\"logo\\\":\\\"https://o3.security/images/O3-text-white.svg\\\",\\\"image\\\":\\\"https://o3.security/opengraph.png\\\",\\\"description\\\":\\\"O3 traces every supply chain attack from the line of code that introduced it to the exploit in production — code, build, runtime, one platform, zero gaps.\\\",\\\"email\\\":\\\"hello@o3.security\\\",\\\"contactPoint\\\":[{\\\"@type\\\":\\\"ContactPoint\\\",\\\"contactType\\\":\\\"sales\\\",\\\"email\\\":\\\"hello@o3.security\\\",\\\"telephone\\\":\\\"+91-70044-85204\\\",\\\"availableLanguage\\\":[\\\"en\\\"],\\\"areaServed\\\":[\\\"IN\\\",\\\"US\\\",\\\"EU\\\"]},{\\\"@type\\\":\\\"ContactPoint\\\",\\\"contactType\\\":\\\"security\\\",\\\"email\\\":\\\"hello@o3.security\\\",\\\"url\\\":\\\"https://o3.security/.well-known/security.txt\\\"}],\\\"sameAs\\\":[\\\"https://www.linkedin.com/company/o3security\\\",\\\"https://twitter.com/o3security\\\",\\\"https://github.com/o3security\\\",\\\"https://www.crunchbase.com/organization/o3-security\\\",\\\"https://www.wikidata.org/wiki/Q140085379\\\"]}\"}}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"WebSite\\\",\\\"@id\\\":\\\"https://o3.security/#website\\\",\\\"name\\\":\\\"O3 Security\\\",\\\"url\\\":\\\"https://o3.security\\\",\\\"description\\\":\\\"O3 traces every supply chain attack from the line of code that introduced it to the exploit in production — code, build, runtime, one platform, zero gaps.\\\",\\\"inLanguage\\\":\\\"en\\\",\\\"dateModified\\\":\\\"2026-06-21\\\",\\\"publisher\\\":{\\\"@id\\\":\\\"https://o3.security/#organization\\\"},\\\"potentialAction\\\":{\\\"@type\\\":\\\"SearchAction\\\",\\\"target\\\":\\\"https://o3.security/?q={search_term_string}\\\",\\\"query-input\\\":\\\"required name=search_term_string\\\"}}\"}}]]}],\"$L4\"]}]]}],{\"children\":[\"$L5\",{\"children\":[\"$L6\",{\"children\":[\"$L7\",{},null,false,null]},null,false,\"$@8\"]},null,false,\"$@8\"]},null,false,null],\"$L9\",false]],\"m\":\"$undefined\",\"G\":[\"$a\",[\"$Lb\",\"$Lc\"]],\"S\":false,\"h\":null,\"s\":\"$undefined\",\"l\":\"$undefined\",\"p\":\"$undefined\",\"d\":\"$undefined\",\"b\":\"tq12gV8bytAGpA548Lacs\"}\n"])</script><script>self.__next_f.push([1,"4:[\"$\",\"body\",null,{\"className\":\"poppins_dc75922d-module__nm-FiW__className geist_mono_8d43a2aa-module__8Li5zG__variable inter_ce929fb-module__qqrwVG__variable min-h-full flex flex-col\",\"children\":[[\"$\",\"$Ld\",null,{\"children\":[\"$\",\"$Le\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Lf\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"div\",null,{\"className\":\"relative min-h-screen bg-surface text-content flex flex-col items-center justify-center px-6 text-center overflow-hidden\",\"children\":[[\"$\",\"$L10\",null,{}],[\"$\",\"div\",null,{\"className\":\"absolute bottom-0 inset-x-0 h-32 pointer-events-none\",\"style\":{\"background\":\"linear-gradient(to bottom, transparent, #000)\"}}],[\"$\",\"div\",null,{\"className\":\"relative z-10 flex flex-col items-center\",\"children\":[[\"$\",\"div\",null,{\"className\":\"inline-flex items-center gap-2 bg-surface-raised border border-line rounded-full px-4 py-1.5 mb-8\",\"children\":[[\"$\",\"span\",null,{\"className\":\"w-1.5 h-1.5 rounded-full bg-accent animate-pulse\"}],[\"$\",\"span\",null,{\"className\":\"text-[11px] font-bold uppercase tracking-[0.2em] text-accent\",\"children\":\"Scan in progress\"}]]}],[\"$\",\"h1\",null,{\"className\":\"text-5xl md:text-7xl font-bold tracking-tighter leading-none mb-2 text-content\",\"children\":\"Lost in space.\"}],[\"$\",\"p\",null,{\"className\":\"text-xl md:text-2xl font-medium text-content-subtle tracking-tight mb-6\",\"children\":\"This page doesn't exist.\"}],[\"$\",\"p\",null,{\"className\":\"text-content-muted text-base max-w-sm mb-2 leading-relaxed\",\"children\":\"But while you're drifting out here —\"}],[\"$\",\"p\",null,{\"className\":\"text-content text-lg md:text-xl font-semibold max-w-lg mb-10 leading-snug text-balance\",\"children\":[\"we probably found\",\" \",[\"$\",\"span\",null,{\"className\":\"text-accent\",\"children\":\"17 vulnerabilities\"}],\" \",\"in your supply chain.\",[\"$\",\"br\",null,{}],[\"$\",\"span\",null,{\"className\":\"text-content-subtle text-base font-normal\",\"children\":\"Want to check?\"}]]}],[\"$\",\"div\",null,{\"className\":\"flex flex-col sm:flex-row items-center gap-3 mb-16\",\"children\":[[\"$\",\"$L11\",null,{\"href\":\"/\",\"className\":\"px-5 h-10 flex items-center gap-2 rounded-lg bg-primary text-primary-foreground font-semibold text-sm hover:scale-[1.02] active:scale-95 transition-all group\",\"children\":[\"Back to safety\",[\"$\",\"$L12\",null,{\"ref\":\"$undefined\",\"iconNode\":[[\"path\",{\"d\":\"m9 18 6-6-6-6\",\"key\":\"mthhwq\"}]],\"className\":\"lucide-chevron-right w-4 h-4 group-hover:translate-x-0.5 transition-transform\"}]]}],[\"$\",\"$L11\",null,{\"href\":\"/software-bill-of-materials-sbom\",\"className\":\"px-5 h-10 flex items-center rounded-lg border border-line-strong text-content font-medium text-sm hover:bg-content/[0.06] transition-all hover:scale-[1.02] active:scale-95\",\"children\":\"Scan my supply chain →\"}]]}],[\"$\",\"div\",null,{\"className\":\"flex flex-wrap justify-center gap-x-6 gap-y-2 text-content-faint text-xs\",\"children\":[[\"$\",\"$L11\",\"/code-shield\",{\"href\":\"/code-shield\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"CodeShield\"}],[\"$\",\"$L11\",\"/agentic-sast\",{\"href\":\"/agentic-sast\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Agentic SAST\"}],[\"$\",\"$L11\",\"/agentic-dast\",{\"href\":\"/agentic-dast\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Agentic DAST\"}],[\"$\",\"$L11\",\"/impact-aware-sca\",{\"href\":\"/impact-aware-sca\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Impact-Aware SCA\"}],[\"$\",\"$L11\",\"/quantum-readiness\",{\"href\":\"/quantum-readiness\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Quantum Readiness\"}]]}]]}]]}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}],[\"$\",\"$L13\",null,{}],[\"$\",\"$L14\",null,{\"gaId\":\"G-KF4FC3MH7X\"}]]}]\n"])</script><script>self.__next_f.push([1,"5:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$Le\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Lf\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n6:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$Le\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$Lf\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n7:[\"$\",\"$1\",\"c\",{\"children\":[\"$L15\",[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/0~6ieyf970fc..js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/0rjqr_md8culd.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-2\",{\"src\":\"/_next/static/chunks/0a~4l9tki~_w6.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-3\",{\"src\":\"/_next/static/chunks/0iblfemvsudyt.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-4\",{\"src\":\"/_next/static/chunks/0kav.n4_38x4q.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-5\",{\"src\":\"/_next/static/chunks/08zulwew.m-~9.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-6\",{\"src\":\"/_next/static/chunks/0b2kepz2375uv.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L16\",null,{\"children\":[\"$\",\"$17\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@18\"}]}]]}]\n19:[]\n8:\"$W19\"\n9:[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L1a\",null,{\"children\":\"$L1b\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L1c\",null,{\"children\":[\"$\",\"$17\",null,{\"name\":\"Next.Metadata\",\"children\":\"$L1d\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}]\nb:[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0llf70t.ingt3.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]\nc:[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0ntsw_cpfvn8d.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]\n1b:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"2\",{\"name\":\"theme-color\",\"content\":\"#030616\",\"media\":\"(prefers-color-scheme: dark)\"}],[\"$\",\"meta\",\"3\",{\"name\":\"theme-color\",\"content\":\"#ffffff\",\"media\":\"(prefers-color-scheme: light)\"}],[\"$\",\"meta\",\"4\",{\"name\":\"color-scheme\",\"content\":\"light dark\"}]]\n"])</script><script>self.__next_f.push([1,"18:null\n"])</script><script>self.__next_f.push([1,"1d:[[\"$\",\"title\",\"0\",{\"children\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea… | O3 Security\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. svelte is vulnerable to XSS with textarea bind:value See affected versions, exploit…\"}],[\"$\",\"meta\",\"2\",{\"name\":\"application-name\",\"content\":\"O3 Security\"}],[\"$\",\"link\",\"3\",{\"rel\":\"author\",\"href\":\"https://o3.security\"}],[\"$\",\"meta\",\"4\",{\"name\":\"author\",\"content\":\"O3 Security\"}],[\"$\",\"link\",\"5\",{\"rel\":\"manifest\",\"href\":\"/site.webmanifest\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"meta\",\"6\",{\"name\":\"keywords\",\"content\":\"GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww vulnerability,GHSA-gw32-9rmw-qwww CVE details,GHSA-gw32-9rmw-qwww affected packages,GHSA-gw32-9rmw-qwww affected versions,GHSA-gw32-9rmw-qwww fix,GHSA-gw32-9rmw-qwww patch,GHSA-gw32-9rmw-qwww remediation,GHSA-gw32-9rmw-qwww exploit,is GHSA-gw32-9rmw-qwww exploitable,how to fix GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww CVSS,svelte vulnerability,npm security,CVE vulnerability details,open source security,supply chain vulnerability,O3 Security scanner\"}],[\"$\",\"meta\",\"7\",{\"name\":\"creator\",\"content\":\"O3 Security\"}],[\"$\",\"meta\",\"8\",{\"name\":\"publisher\",\"content\":\"O3 Security Inc.\"}],[\"$\",\"meta\",\"9\",{\"name\":\"robots\",\"content\":\"index, follow\"}],[\"$\",\"meta\",\"10\",{\"name\":\"googlebot\",\"content\":\"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1\"}],[\"$\",\"meta\",\"11\",{\"name\":\"category\",\"content\":\"Cybersecurity\"}],[\"$\",\"link\",\"12\",{\"rel\":\"canonical\",\"href\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"}],[\"$\",\"meta\",\"13\",{\"name\":\"mobile-web-app-capable\",\"content\":\"yes\"}],[\"$\",\"meta\",\"14\",{\"name\":\"apple-mobile-web-app-title\",\"content\":\"O3 Security\"}],[\"$\",\"meta\",\"15\",{\"name\":\"apple-mobile-web-app-status-bar-style\",\"content\":\"default\"}],[\"$\",\"meta\",\"16\",{\"property\":\"og:title\",\"content\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea…\"}],[\"$\",\"meta\",\"17\",{\"property\":\"og:description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. svelte is vulnerable to XSS with textarea bind:value See affected versions, exploit…\"}],[\"$\",\"meta\",\"18\",{\"property\":\"og:url\",\"content\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"}],[\"$\",\"meta\",\"19\",{\"property\":\"og:image\",\"content\":\"https://o3.security/opengraph.png\"}],[\"$\",\"meta\",\"20\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"21\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"22\",{\"property\":\"og:image:alt\",\"content\":\"GHSA-gw32-9rmw-qwww vulnerability details — O3 Security\"}],[\"$\",\"meta\",\"23\",{\"property\":\"og:type\",\"content\":\"article\"}],[\"$\",\"meta\",\"24\",{\"property\":\"article:published_time\",\"content\":\"2026-01-16T21:02:56Z\"}],[\"$\",\"meta\",\"25\",{\"property\":\"article:modified_time\",\"content\":\"2026-02-03T03:17:01.517258Z\"}],[\"$\",\"meta\",\"26\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"27\",{\"name\":\"twitter:site\",\"content\":\"@o3security\"}],[\"$\",\"meta\",\"28\",{\"name\":\"twitter:creator\",\"content\":\"@mutex\"}],[\"$\",\"meta\",\"29\",{\"name\":\"twitter:title\",\"content\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea…\"}],[\"$\",\"meta\",\"30\",{\"name\":\"twitter:description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. svelte is vulnerable to XSS with textarea bind:value See affected versions, exploit…\"}],[\"$\",\"meta\",\"31\",{\"name\":\"twitter:image\",\"content\":\"https://o3.security/opengraph.png\"}],[\"$\",\"meta\",\"32\",{\"name\":\"twitter:image:alt\",\"content\":\"GHSA-gw32-9rmw-qwww vulnerability details — O3 Security\"}],[\"$\",\"meta\",\"33\",{\"name\":\"twitter:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"34\",{\"name\":\"twitter:image:height\",\"content\":\"630\"}],[\"$\",\"link\",\"35\",{\"rel\":\"shortcut icon\",\"href\":\"/favicon.ico\"}],[\"$\",\"link\",\"36\",{\"rel\":\"icon\",\"href\":\"/favicon.ico?favicon.0t73vdlmfqa-9.ico\",\"sizes\":\"48x48\",\"type\":\"image/x-icon\"}],[\"$\",\"link\",\"37\",{\"rel\":\"icon\",\"href\":\"/favicon-96x96.png\",\"sizes\":\"96x96\",\"type\":\"image/png\"}],\"$L1e\",\"$L1f\",\"$L20\",\"$L21\"]\n"])</script><script>self.__next_f.push([1,"22:I[496150,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"IconMark\"]\n1e:[\"$\",\"link\",\"38\",{\"rel\":\"icon\",\"href\":\"/favicon.svg\",\"type\":\"image/svg+xml\"}]\n1f:[\"$\",\"link\",\"39\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\"}]\n20:[\"$\",\"link\",\"40\",{\"rel\":\"apple-touch-icon\",\"href\":\"/apple-touch-icon.png\",\"sizes\":\"180x180\"}]\n21:[\"$\",\"$L22\",\"41\",{}]\n"])</script><script>self.__next_f.push([1,"23:T632,"])</script><script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#article\",\"headline\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value\",\"description\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only a\",\"datePublished\":\"2026-01-16T21:02:56Z\",\"dateModified\":\"2026-02-03T03:17:01.517258Z\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\",\"inLanguage\":\"en\",\"author\":{\"@id\":\"https://o3.security/#organization\"},\"publisher\":{\"@id\":\"https://o3.security/#organization\"},\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"},\"speakable\":{\"@type\":\"SpeakableSpecification\",\"cssSelector\":[\"h1\",\".vuln-summary\",\".vuln-severity\",\".vuln-mitigation\"]},\"about\":[{\"@type\":\"SoftwareApplication\",\"name\":\"svelte\",\"applicationCategory\":\"npm\",\"softwareVersion\":\"3.59.2\"}],\"citation\":[{\"@type\":\"WebPage\",\"url\":\"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww\"},{\"@type\":\"WebPage\",\"url\":\"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc\"}]}"])</script><script>self.__next_f.push([1,"24:T44c,{\"@context\":\"https://schema.org\",\"@type\":\"Dataset\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#record\",\"name\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value\",\"description\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only a\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\",\"identifier\":\"GHSA-gw32-9rmw-qwww\",\"datePublished\":\"2026-01-16T21:02:56Z\",\"dateModified\":\"2026-02-03T03:17:01.517258Z\",\"inLanguage\":\"en\",\"keywords\":[\"GHSA-gw32-9rmw-qwww\",\"CVE\",\"vulnerability\",\"security advisory\"],\"creator\":{\"@id\":\"https://o3.security/#organization\"},\"isAccessibleForFree\":true}15:[[[\"$\",\"script\",\"0\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"BreadcrumbList\\\",\\\"itemListElement\\\":[{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":1,\\\"name\\\":\\\"Home\\\",\\\"item\\\":\\\"https://o3.security\\\"},{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":2,\\\"name\\\":\\\"Vulnerability Database\\\",\\\"item\\\":\\\"https://o3.security/vulnerability\\\"},{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":3,\\\"name\\\":\\\"GHSA-gw32-9rmw-qwww\\\",\\\"item\\\":\\\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\\\"}]}\"}}],[\"$\",\"script\",\"1\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$23\"}}],[\"$\",\"script\",\"2\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$24\"}}],\"$L25\",\"$L26\"],\"$L27\"]\n"])</script><script>self.__next_f.push([1,"2a:I[651326,[\"/_next/static/chunks/0quebjc6y~.bo.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0~6ieyf970fc..js\",\"/_next/static/chunks/0rjqr_md8culd.js\",\"/_next/static/chunks/0a~4l9tki~_w6.js\",\"/_next/static/chunks/0iblfemvsudyt.js\",\"/_next/static/chunks/0kav.n4_38x4q.js\",\"/_next/static/chunks/08zulwew.m-~9.js\",\"/_next/static/chunks/0b2kepz2375uv.js\"],\"default\"]\n28:T4af,{\"@context\":\"https://schema.org\",\"@type\":\"HowTo\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#howtofix\",\"name\":\"How to fix GHSA-gw32-9rmw-qwww\",\"description\":\"Step-by-step remediation for GHSA-gw32-9rmw-qwww.\",\"step\":[{\"@type\":\"HowToStep\",\"position\":1,\"name\":\"Update svelte to 3.59.2 or later\",\"text\":\"Upgrade svelte to 3.59.2 or newer with your package manager — the version where GHSA-gw32-9rmw-qwww is patched.\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-1\"},{\"@type\":\"HowToStep\",\"position\":2,\"name\":\"Check transitive dependencies\",\"text\":\"Verify no transitive (indirect) dependency still pins the vulnerable version of svelte.\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-2\"},{\"@type\":\"HowToStep\",\"position\":3,\"name\":\"Verify reachability with Impact-Aware SCA\",\"text\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#fix-step-3\"}]}25:[\"$\",\"script\",\"3\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$28\"}}]\n29:Te03,"])</script><script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"FAQPage\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#faq\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\"}},{\"@type\":\"Question\",\"name\":\"How severe is GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure.\"}},{\"@type\":\"Question\",\"name\":\"Which packages are affected by GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm.\"}},{\"@type\":\"Question\",\"name\":\"How do I fix GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\"}},{\"@type\":\"Question\",\"name\":\"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.\"}},{\"@type\":\"Question\",\"name\":\"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\"}},{\"@type\":\"Question\",\"name\":\"How does O3 Security protect against GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"O3 pinpoints whether GHSA-gw32-9rmw-qwww is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.\"}},{\"@type\":\"Question\",\"name\":\"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.\"}},{\"@type\":\"Question\",\"name\":\"When was GHSA-gw32-9rmw-qwww published, and has it been updated?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.\"}}]}"])</script><script>self.__next_f.push([1,"26:[\"$\",\"script\",\"4\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$29\"}}]\n"])</script><script>self.__next_f.push([1,"27:[\"$\",\"$L2a\",null,{\"vuln\":{\"id\":\"GHSA-gw32-9rmw-qwww\",\"summary\":\"svelte is vulnerable to XSS with textarea bind:value\",\"details\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\",\"modified\":\"2026-02-03T03:17:01.517258Z\",\"published\":\"2026-01-16T21:02:56Z\",\"database_specific\":{\"github_reviewed\":true,\"cwe_ids\":[\"CWE-79\"],\"nvd_published_at\":null,\"severity\":\"HIGH\",\"github_reviewed_at\":\"2026-01-16T21:02:56Z\"},\"references\":[{\"type\":\"WEB\",\"url\":\"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww\"},{\"type\":\"WEB\",\"url\":\"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc\"},{\"type\":\"PACKAGE\",\"url\":\"https://github.com/sveltejs/svelte\"}],\"affected\":[{\"package\":{\"name\":\"svelte\",\"ecosystem\":\"npm\",\"purl\":\"pkg:npm/svelte\"},\"ranges\":[{\"type\":\"SEMVER\",\"events\":[{\"introduced\":\"3.0.0\"},{\"fixed\":\"3.59.2\"}]}],\"database_specific\":{\"source\":\"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-gw32-9rmw-qwww/GHSA-gw32-9rmw-qwww.json\"}}],\"schema_version\":\"1.7.3\",\"severity\":[{\"type\":\"CVSS_V4\",\"score\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N\"}]},\"cvss\":null,\"affected\":[\"$27:props:vuln:affected:0\"],\"faqs\":[{\"question\":\"What is GHSA-gw32-9rmw-qwww?\",\"answer\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\"},{\"question\":\"How severe is GHSA-gw32-9rmw-qwww?\",\"answer\":\"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure.\"},{\"question\":\"Which packages are affected by GHSA-gw32-9rmw-qwww?\",\"answer\":\"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm.\"},{\"question\":\"How do I fix GHSA-gw32-9rmw-qwww?\",\"answer\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\"},{\"question\":\"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?\",\"answer\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.\"},{\"question\":\"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?\",\"answer\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\"},{\"question\":\"How does O3 Security protect against GHSA-gw32-9rmw-qwww?\",\"answer\":\"O3 pinpoints whether GHSA-gw32-9rmw-qwww is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.\"},{\"question\":\"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?\",\"answer\":\"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.\"},{\"question\":\"When was GHSA-gw32-9rmw-qwww published, and has it been updated?\",\"answer\":\"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.\"}],\"cveId\":\"GHSA-gw32-9rmw-qwww\",\"exploits\":{\"total\":0,\"offensiveSecurity\":[],\"inTheWild\":[],\"github\":[]},\"epss\":null,\"kev\":null,\"scorecard\":{\"date\":\"2026-06-15\",\"repo\":{\"name\":\"github.com/sveltejs/svelte\",\"commit\":\"c4daa490bbbf483ebba117c1afb6f71b4b19e63c\"},\"scorecard\":{\"version\":\"v5.5.1-0.20260519155427-916bfc57fa74\",\"commit\":\"916bfc57fa7431467a33a5a013cba3f8a0c1ec50\"},\"score\":6.5,\"checks\":[{\"name\":\"Packaging\",\"score\":-1,\"reason\":\"packaging workflow not detected\",\"details\":[\"Warn: no GitHub/GitLab publishing workflow detected.\"],\"documentation\":{\"short\":\"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#packaging\"}},{\"name\":\"Code-Review\",\"score\":9,\"reason\":\"Found 23/25 approved changesets -- score normalized to 9\",\"details\":null,\"documentation\":{\"short\":\"Determines if the project requires human code review before pull requests (aka merge requests) are merged.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#code-review\"}},{\"name\":\"Maintained\",\"score\":10,\"reason\":\"30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10\",\"details\":null,\"documentation\":{\"short\":\"Determines if the project is \\\"actively maintained\\\".\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#maintained\"}},{\"name\":\"Dangerous-Workflow\",\"score\":0,\"reason\":\"dangerous workflow patterns detected\",\"details\":[\"Warn: untrusted code checkout '${{ github.event.pull_request.head.sha || inputs.sha || github.sha }}': .github/workflows/pkg.pr.new.yml:31\"],\"documentation\":{\"short\":\"Determines if the project's GitHub Action workflows avoid dangerous patterns.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#dangerous-workflow\"}},{\"name\":\"Token-Permissions\",\"score\":10,\"reason\":\"GitHub workflow tokens follow principle of least privilege\",\"details\":[\"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/autofix.yml:13\",\"Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/autofix.yml:14\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: jobLevel 'actions' permission set to 'read': .github/workflows/ecosystem-ci-trigger.yml:16\",\"Info: jobLevel 'contents' permission set to 'read': .github/workflows/ecosystem-ci-trigger.yml:17\",\"Info: found token with 'none' permissions: .github/workflows/pkg.pr.new.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/pkg.pr.new.yml:1\",\"Info: jobLevel 'contents' permission set to 'read': .github/workflows/pkg.pr.new.yml:115\",\"Info: found token with 'none' permissions: .github/workflows/pkg.pr.new.yml:1\",\"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:19\",\"Info: found token with 'none' permissions: .github/workflows/autofix.yml:1\",\"Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:7\",\"Info: found token with 'none' permissions: .github/workflows/ecosystem-ci-trigger.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/pkg.pr.new.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/release.yml:1\"],\"documentation\":{\"short\":\"Determines if the project's workflows follow the principle of least privilege.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#token-permissions\"}},{\"name\":\"CII-Best-Practices\",\"score\":0,\"reason\":\"no effort to earn an OpenSSF best practices badge detected\",\"details\":null,\"documentation\":{\"short\":\"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#cii-best-practices\"}},{\"name\":\"License\",\"score\":10,\"reason\":\"license file detected\",\"details\":[\"Info: project has a license file: LICENSE.md:0\",\"Info: FSF or OSI recognized license: MIT License: LICENSE.md:0\"],\"documentation\":{\"short\":\"Determines if the project has defined a license.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#license\"}},{\"name\":\"Signed-Releases\",\"score\":-1,\"reason\":\"no releases found\",\"details\":null,\"documentation\":{\"short\":\"Determines if the project cryptographically signs release artifacts.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#signed-releases\"}},{\"name\":\"Branch-Protection\",\"score\":-1,\"reason\":\"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md\",\"details\":null,\"documentation\":{\"short\":\"Determines if the default and release branches are protected with GitHub's branch protection settings.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#branch-protection\"}},{\"name\":\"Security-Policy\",\"score\":10,\"reason\":\"security policy file detected\",\"details\":[\"Info: security policy file detected: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found linked content: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found text in security policy: github.com/sveltejs/.github/SECURITY.md:1\"],\"documentation\":{\"short\":\"Determines if the project has published a security policy.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#security-policy\"}},{\"name\":\"Pinned-Dependencies\",\"score\":5,\"reason\":\"dependency not pinned by hash detected -- score normalized to 5\",\"details\":[\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autofix.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/autofix.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autofix.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/autofix.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autofix.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/autofix.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ci.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ecosystem-ci-trigger.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ecosystem-ci-trigger.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ecosystem-ci-trigger.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/ecosystem-ci-trigger.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:203: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/pkg.pr.new.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/release.yml/main?enable=pin\",\"Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/sveltejs/svelte/release.yml/main?enable=pin\",\"Info:   0 out of  30 GitHub-owned GitHubAction dependencies pinned\",\"Info:   9 out of   9 third-party GitHubAction dependencies pinned\"],\"documentation\":{\"short\":\"Determines if the project has declared and pinned the dependencies of its build process.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#pinned-dependencies\"}},{\"name\":\"Binary-Artifacts\",\"score\":10,\"reason\":\"no binaries found in the repo\",\"details\":null,\"documentation\":{\"short\":\"Determines if the project has generated executable (binary) artifacts in the source repository.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#binary-artifacts\"}},{\"name\":\"Fuzzing\",\"score\":0,\"reason\":\"project is not fuzzed\",\"details\":[\"Warn: no fuzzer integrations found\"],\"documentation\":{\"short\":\"Determines if the project uses fuzzing.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#fuzzing\"}},{\"name\":\"SAST\",\"score\":6,\"reason\":\"SAST tool is not run on all commits -- score normalized to 6\",\"details\":[\"Warn: 19 commits out of 30 are checked with a SAST tool\"],\"documentation\":{\"short\":\"Determines if the project uses static code analysis.\",\"url\":\"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#sast\"}}]},\"nvd\":null,\"packageDownloads\":{\"svelte\":{\"weeklyDownloads\":4771757,\"ecosystem\":\"npm\"}},\"nuclei\":{\"hasTemplate\":false},\"metasploit\":{\"hasModule\":false,\"count\":0},\"attackerKb\":null,\"mitigation\":{\"detect\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.\",\"fix\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\",\"workaround\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\",\"o3\":\"O3 pinpoints whether GHSA-gw32-9rmw-qwww is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.\"},\"archetype\":\"oss\",\"hasFix\":true}]\n"])</script></body></html>