Impact: Only affects SSR Needs a <textarea bind:value>","image":"https://o3.security/opengraph.png","datePublished":"2026-01-16T21:02:56Z","dateModified":"2026-02-03T03:17:01.517258Z","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"svelte","applicationCategory":"npm","softwareVersion":"3.59.2"}],"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww"},{"@type":"CreativeWork","url":"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww"},{"@type":"CreativeWork","url":"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc"}]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"Dataset","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#record","name":"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value","description":"Summary: A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML. Details: In SSR, <textarea bind:value={...}> does not have its value escaped when it is rendered into the HTML as <textarea>...

. PoC: Put this in a server-side-rendered Svelte component:

Impact: Only affects SSR Needs a <textarea bind:value>","url":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww","identifier":"GHSA-gw32-9rmw-qwww","datePublished":"2026-01-16T21:02:56Z","dateModified":"2026-02-03T03:17:01.517258Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["GHSA-gw32-9rmw-qwww","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww"}]}</script><script type="application/ld+json">{"@context":"https://schema.org","@type":"FAQPage","@id":"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#faq","mainEntity":[{"@type":"Question","name":"What is GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"### Summary\n\nA server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.\n\n### Details\n\nIn SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...

`.\n\n### PoC\n\nPut this in a server-side-rendered Svelte component:\n\n```\n\n\n

\n```\n\n### Impact\n\n- Only affects SSR\n- Needs a `<textarea bind:value>` filled by user content via two-way binding"}},{"@type":"Question","name":"How severe is GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure."}},{"@type":"Question","name":"Which packages are affected by GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm."}},{"@type":"Question","name":"How do I fix GHSA-gw32-9rmw-qwww?","acceptedAnswer":{"@type":"Answer","text":"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands."}},{"@type":"Question","name":"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"When was GHSA-gw32-9rmw-qwww published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}</script><div class="min-h-screen bg-surface text-content selection:bg-[#5136d2]/30 selection:text-content"><header class="fixed inset-x-0 top-0 z-40"><div class="grid transition-[grid-template-rows] duration-300 ease-in-out grid-rows-[1fr]" aria-hidden="false"><div class="relative z-40 flex w-full min-h-0 items-center justify-center px-4 text-xs md:text-sm overflow-hidden bg-[#111111]"><div class="py-3 w-full flex items-center justify-center"><div class="flex items-center justify-center gap-3 text-[11px] md:text-xs font-medium text-white pr-8"><span>NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.</span><a class="hidden md:flex items-center gap-1 text-white font-bold hover:underline decoration-white/30 underline-offset-2" href="/cryptographic-bill-of-materials">See O3 CBOM <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right size-3" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a></div></div><button class="absolute top-1/2 right-3 -translate-y-1/2 cursor-pointer text-white/60 hover:text-white transition-colors" aria-label="Dismiss banner" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-x size-3.5" aria-hidden="true"><path d="M18 6 6 18"></path><path d="m6 6 12 12"></path></svg></button><div class="absolute bottom-0 left-0 right-0 h-px bg-gradient-to-r from-o3-signal-cyan via-o3-violet to-o3-lavender opacity-80"></div></div></div><nav class="relative w-full transition-colors duration-300 bg-surface-overlay border-b border-transparent"><div class="mx-auto w-full max-w-[1440px] px-4 sm:px-6 lg:px-8"><div class="flex items-center justify-between h-16"><a class="flex items-center shrink-0 z-20 px-2" href="/"><img src="/images/O3-text-white.svg" alt="O3 Security" class="h-5 md:h-6 w-auto object-contain"/></a><nav aria-label="Main" data-orientation="horizontal" dir="ltr" class="z-10 max-w-max items-center hidden lg:flex flex-1 justify-center px-4"><div style="position:relative"><ul data-orientation="horizontal" class="group flex flex-1 list-none items-center justify-center space-x-1" dir="ltr"><li><button id="radix-_R_4pinpfiudb_-trigger-radix-_R_5kpinpfiudb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_4pinpfiudb_-content-radix-_R_5kpinpfiudb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">Product <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><button id="radix-_R_4pinpfiudb_-trigger-radix-_R_9kpinpfiudb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_4pinpfiudb_-content-radix-_R_9kpinpfiudb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">BOM Suite <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><button id="radix-_R_4pinpfiudb_-trigger-radix-_R_dkpinpfiudb_" data-state="closed" aria-expanded="false" aria-controls="radix-_R_4pinpfiudb_-content-radix-_R_dkpinpfiudb_" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content group" data-radix-collection-item="">Compliance <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down relative top-[1px] ml-1 h-3 w-3 transition duration-300 group-data-[state=open]:rotate-180" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></button></li><li><a href="/threat-center" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content" data-radix-collection-item="">Threat Center</a></li><li><a href="/tools" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content" data-radix-collection-item="">Tools</a></li><li><a href="/academy" class="group inline-flex h-9 w-max items-center justify-center rounded-md bg-transparent px-4 py-2 text-sm font-medium text-content-muted transition-colors hover:bg-content/[0.06] hover:text-content focus:bg-content/[0.06] focus:text-content focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[state=open]:bg-content/[0.06] data-[state=open]:text-content" data-radix-collection-item="">Academy</a></li></ul></div><div class="absolute left-1/2 top-full flex -translate-x-1/2 justify-center z-50"></div></nav><div class="hidden lg:flex items-center gap-3"><a class="flex items-center px-3.5 h-[34px] rounded-lg bg-red-800 hover:bg-red-900 border border-red-700/20 text-white text-xs font-medium tracking-wide active:scale-[0.98] transition-all" href="/supplychain-under-attack-help">Under attack?</a><a class="flex items-center justify-center px-4 h-[34px] bg-primary text-primary-foreground rounded-lg font-semibold text-xs hover:bg-primary/90 transition-colors duration-300 hover:scale-[1.02] active:scale-95" href="/book-demo">Book a Demo</a></div><div class="lg:hidden flex items-center gap-2"><button type="button" aria-label="Open menu" class="flex items-center justify-center size-9 rounded-md border border-line text-content hover:bg-content/[0.05] transition-colors"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-menu size-5" aria-hidden="true"><path d="M4 5h16"></path><path d="M4 12h16"></path><path d="M4 19h16"></path></svg></button></div></div></div></nav></header><div class="relative z-10 pt-[88px]"><div class="absolute inset-0 opacity-[0.015] pointer-events-none bg-[url('/noise.svg')]"></div><main class="relative max-w-[1160px] mx-auto px-4 sm:px-6 py-8 lg:py-12"><nav class="flex items-center gap-1.5 text-[12px] text-content-faint mb-8"><a class="hover:text-content-muted transition-colors" href="/">Home</a><span class="text-line-strong">/</span><a class="hover:text-content-muted transition-colors" href="/vulnerability">Vulnerabilities</a><span class="text-line-strong">/</span><span class="font-mono text-content-muted">GHSA-gw32-9rmw-qwww</span></nav><div class="flex flex-col xl:flex-row gap-7"><div class="flex-1 min-w-0 space-y-5"><div class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="relative"><div class="absolute inset-0 bg-surface"></div><div class="relative px-6 md:px-8 pt-6 pb-5"><div class="flex flex-wrap items-center justify-between gap-3 mb-5"><div class="flex flex-wrap gap-1.5"><span class="inline-flex items-center gap-1.5 text-[11px] px-2.5 py-1 rounded-full bg-line border border-line-strong text-content-subtle font-medium"><span class="text-base leading-none">📦</span> npm</span></div><span class="text-[11px] font-semibold px-3 py-1.5 rounded-full text-content-faint">Not in CISA KEV</span></div><div class="flex flex-wrap items-center gap-3 mb-4"><h1 class="text-[28px] sm:text-[36px] font-bold tracking-tight text-content leading-tight"><span class="font-sans">svelte is vulnerable to XSS with textarea bind:value</span><span class="block font-mono text-[14px] sm:text-[16px] text-content-faint font-medium mt-1.5">GHSA-gw32-9rmw-qwww</span></h1><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button><a href="https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc" target="_blank" rel="noopener noreferrer" class="inline-flex items-center gap-1.5 text-[11px] font-medium px-2.5 py-1 rounded-full bg-line border border-line-strong text-content-subtle hover:text-content hover:bg-line-strong transition-all"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-git-commit-horizontal text-[#5136d2]" aria-hidden="true"><circle cx="12" cy="12" r="3"></circle><line x1="3" x2="9" y1="12" y2="12"></line><line x1="15" x2="21" y1="12" y2="12"></line></svg>Fix: sveltejs/svelte@a31dec5</a></div><p class="vuln-summary text-[15px] text-content-muted leading-[1.7] max-w-2xl mb-0">GHSA-gw32-9rmw-qwww is a security vulnerability in svelte. A fix is available for svelte — see the affected versions and patch details below.</p></div></div><div class="mt-6 border-t border-line grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-5 divide-x divide-line"><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-calendar" aria-hidden="true"><path d="M8 2v4"></path><path d="M16 2v4"></path><rect width="18" height="18" x="3" y="4" rx="2"></rect><path d="M3 10h18"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Published</span></div><div class="text-[14px] font-semibold text-content"><time dateTime="2026-01-16T21:02:56Z">Jan 16, 2026</time></div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-refresh-cw" aria-hidden="true"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"></path><path d="M21 3v5h-5"></path><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"></path><path d="M8 16H3v5"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Updated</span></div><div class="text-[14px] font-semibold text-content"><time dateTime="2026-02-03T03:17:01.517258Z">Feb 3, 2026</time></div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-package" aria-hidden="true"><path d="M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z"></path><path d="M12 22V12"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><path d="m7.5 4.27 9 5.15"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Affected</span></div><div class="text-[14px] font-semibold text-content">1 pkg</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check text-content-faint" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Patched</span></div><div class="text-[14px] font-semibold text-content">1 / 1</div></div><div class="flex flex-col gap-1 px-5 py-4"><div class="flex items-center gap-1.5 text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-flame-kindling text-content-faint" aria-hidden="true"><path d="M12 2c1 3 2.5 3.5 3.5 4.5A5 5 0 0 1 17 10a5 5 0 1 1-10 0c0-.3 0-.6.1-.9a2 2 0 1 0 3.3-2C8 4.5 11 2 12 2Z"></path><path d="m5 22 14-4"></path><path d="m5 18 14 4"></path></svg><span class="text-[10px] uppercase tracking-widest font-semibold">Exploits</span></div><div class="text-[14px] font-semibold text-content">None indexed</div></div></div><div class="px-5 py-2 border-t border-line flex items-center gap-1.5 text-[10px] text-content-faint"><span class="w-1.5 h-1.5 rounded-full bg-emerald-500 shrink-0"></span>Exploitation data as of Feb 3, 2026 · OSV.dev, FIRST.org (EPSS)</div></div><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center justify-between px-5 py-3.5 border-b border-line"><div class="flex items-center gap-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-trending-up text-[#5136d2]" aria-hidden="true"><path d="M16 7h6v6"></path><path d="m22 7-8.5 8.5-5-5L2 17"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Real-World Exposure</h2></div><span class="text-[11px] text-content-faint">1 pkg affected</span></div><div class="p-5"><p class="text-[12px] text-content-faint mb-4 leading-relaxed">How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.</p><div class="flex items-center gap-3 mb-4 px-4 py-3 rounded-xl border border-line bg-surface"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-package text-[#5136d2] shrink-0" aria-hidden="true"><path d="M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z"></path><path d="M12 22V12"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><path d="m7.5 4.27 9 5.15"></path></svg><div><span class="text-[18px] font-bold tabular-nums text-content">2K</span><span class="text-[12px] text-content-faint ml-1.5">other npm packages depend on this — each one inherits the vulnerability until it's patched upstream</span></div></div><div class="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-3"><div class="flex flex-col gap-2 px-4 py-3 rounded-xl border border-line bg-surface"><div class="flex items-center justify-between gap-2"><code class="text-[12px] font-mono text-content truncate">svelte</code><span class="shrink-0 text-[10px] font-semibold px-1.5 py-0.5 rounded border bg-line border-line-strong text-content-subtle">npm</span></div><div><span class="text-[24px] font-bold tabular-nums text-content leading-none">9.3M</span><span class="text-[11px] text-content-faint ml-1.5">downloads / week</span></div><div class="h-1.5 rounded-full bg-line overflow-hidden"><div class="h-full rounded-full bg-[#5136d2] transition-all" style="width:100%"></div></div></div></div></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center gap-2.5 px-5 py-3.5 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield text-[#5136d2]" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Description</h2></div><div class="px-5 py-5"><h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Summary</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">A server-side rendered <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea></code> with two-way bound value does not have its value correctly escaped in the rendered HTML.</p>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Details</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">In SSR, <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea bind:value={...}></code> does not have its value escaped when it is rendered into the HTML as <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea>...</textarea></code>.</p>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">PoC</h4>
<p class="text-[14px] text-content-body leading-[1.8] mb-3 last:mb-0">Put this in a server-side-rendered Svelte component:</p>
<pre class="my-3 rounded-xl border border-line bg-surface overflow-x-auto"><code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />
</code></pre>
<h4 class="text-[14px] font-semibold text-content-muted mt-4 mb-1.5">Impact</h4>
<ul class="list-disc list-inside space-y-1 mb-3 pl-1 text-[14px] text-content-muted">
<li class="leading-[1.7] marker:text-content-faint">Only affects SSR</li>
<li class="leading-[1.7] marker:text-content-faint">Needs a <code class="text-[12px] font-mono text-content-subtle bg-line border border-line-strong rounded px-1.5 py-0.5 mx-0.5"><textarea bind:value></code> filled by user content via two-way binding</li>
</ul></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center justify-between px-5 py-3.5 border-b border-line"><div class="flex items-center gap-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-package text-[#5136d2]" aria-hidden="true"><path d="M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z"></path><path d="M12 22V12"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><path d="m7.5 4.27 9 5.15"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Affected Packages</h2></div><div class="flex items-center gap-3 text-[12px]"><span class="text-content-faint">1 total</span><span class="flex items-center gap-1 text-green-600 dark:text-green-400"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg> 1 fixed</span></div></div><div class="p-4"><div><div class="rounded-xl border border-line overflow-hidden"><table class="w-full text-sm"><thead><tr class="bg-surface-raised border-b border-line"><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Ecosystem</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Package</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Vulnerable range</th><th class="text-left px-4 py-2.5 text-content-faint font-medium text-[11px] uppercase tracking-widest">Fix</th></tr></thead><tbody class="divide-y divide-line"><tr class="bg-surface hover:bg-surface-raised transition-colors group"><td class="px-4 py-3"><span class="flex items-center gap-2 text-content-muted text-[13px]"><span class="text-base leading-none">📦</span>npm</span></td><td class="px-4 py-3"><span class="flex items-center gap-2"><code class="text-[13px] text-content font-mono">svelte</code><span class="opacity-0 group-hover:opacity-100 transition-opacity"><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button></span></span></td><td class="px-4 py-3 font-mono text-[12px]"><span class="text-orange-500 dark:text-orange-400">≥ 3.0.0</span><span class="text-content-faint mx-1">&&</span><span class="text-content-faint">< 3.59.2</span></td><td class="px-4 py-3 text-[12px]"><span class="flex flex-col gap-1.5"><span class="inline-flex w-fit items-center gap-1.5 px-2 py-0.5 rounded-full bg-line border border-line-strong text-content-subtle font-mono text-[11px]"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg>3.59.2</span><span></span><code class="block text-[10.5px] font-mono text-content-faint break-all">npm install svelte@3.59.2</code><span></span></span></td></tr></tbody></table></div></div></div></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden" id="mitigation"><div class="px-5 py-4 border-b border-line flex items-center justify-between gap-2"><h2 class="text-[12px] font-semibold text-content">Detection & mitigation playbook</h2><span class="text-[10px] font-medium text-content-subtle px-2 py-0.5 rounded-full border border-line">Open-source dependency</span></div><ol class="p-5 pt-4"><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-search" aria-hidden="true"><path d="m21 21-4.34-4.34"></path><circle cx="11" cy="11" r="8"></circle></svg></span><span class="w-px flex-1 my-1 bg-line" aria-hidden="true"></span></div><div class="flex-1 pb-5"><h3 class="text-[13px] font-semibold mb-1 text-content">Detect</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.</p></div></li><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-refresh-cw" aria-hidden="true"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"></path><path d="M21 3v5h-5"></path><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"></path><path d="M8 16H3v5"></path></svg></span><span class="w-px flex-1 my-1 bg-line" aria-hidden="true"></span></div><div class="flex-1 pb-5"><h3 class="text-[13px] font-semibold mb-1 text-content">Fix</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.</p></div></li><li class="flex gap-3.5"><div class="flex flex-col items-center"><span class="shrink-0 grid place-items-center size-7 rounded-full bg-surface border border-line text-content-subtle"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-triangle-alert" aria-hidden="true"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"></path><path d="M12 9v4"></path><path d="M12 17h.01"></path></svg></span></div><div class="flex-1 "><h3 class="text-[13px] font-semibold mb-1 text-content">Workarounds</h3><p class="vuln-mitigation text-[12.5px] text-content-muted leading-[1.7]">If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.</p></div></li></ol></section><section class="relative rounded-2xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/30 to-transparent"></div><div class="flex items-center gap-2.5 px-5 py-3.5 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-trending-up text-[#5136d2]" aria-hidden="true"><path d="M16 7h6v6"></path><path d="m22 7-8.5 8.5-5-5L2 17"></path></svg><h2 class="text-[11px] font-semibold text-content-subtle uppercase tracking-widest">Frequently Asked Questions</h2></div><div class="p-4"><div class="divide-y divide-line rounded-xl border border-line overflow-hidden"><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">What is GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-up" aria-hidden="true"><path d="m18 15-6-6-6 6"></path></svg></span></button><div class="px-5 pb-5 pt-2 text-content-muted text-[14px] leading-relaxed border-t border-line">### Summary

A server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.

### Details

In SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...</textarea>`.

### PoC

Put this in a server-side-rendered Svelte component:

```
<script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />
```

### Impact

- Only affects SSR
- Needs a `<textarea bind:value>` filled by user content via two-way binding</div></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How severe is GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">Which packages are affected by GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I fix GHSA-gw32-9rmw-qwww?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">Is GHSA-gw32-9rmw-qwww actively exploited in the wild?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div><div><button class="w-full flex items-center justify-between px-5 py-4 text-left hover:bg-line transition-colors"><span class="font-medium text-content text-[14px] pr-6 leading-snug">When was GHSA-gw32-9rmw-qwww published, and has it been updated?</span><span class="shrink-0 w-5 h-5 rounded-full border border-line flex items-center justify-center text-content-faint"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down" aria-hidden="true"><path d="m6 9 6 6 6-6"></path></svg></span></button></div></div></div></section><section class="relative rounded-2xl overflow-hidden border border-[#5136d2]/30 bg-surface-raised"><div class="absolute inset-0 bg-gradient-to-br from-[#5136d2]/[0.07] to-transparent pointer-events-none"></div><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/40 to-transparent"></div><div class="relative p-6 md:p-8"><div class="flex flex-col md:flex-row md:items-center gap-6"><div class="flex-1"><div class="text-[11px] font-bold uppercase tracking-[0.15em] text-[#a78bfa] mb-3">O3 Security · Impact-Aware SCA</div><h3 class="text-[19px] font-semibold text-content mb-2">Is <span class="font-mono text-[#5136d2]">GHSA-gw32-9rmw-qwww</span> in your dependencies?</h3><p class="text-[14px] text-content-muted leading-relaxed max-w-lg">Find it across npm, including transitive dependencies.</p></div><div class="flex flex-col gap-2.5 shrink-0"><a class="inline-flex items-center justify-center gap-2 px-5 py-2.5 rounded-xl bg-[#5136d2] hover:bg-[#4429bc] text-white text-[13px] font-semibold transition-all hover:scale-[1.02] active:scale-95 whitespace-nowrap" href="/book-demo">Scan my dependencies <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="inline-flex items-center justify-center gap-2 px-5 py-2.5 rounded-xl border border-line-strong text-content-muted hover:text-content text-[13px] font-medium transition-all hover:bg-content/[0.06] hover:scale-[1.02] active:scale-95 whitespace-nowrap" href="/impact-aware-sca">How O3 SCA works</a></div></div></div></section></div><aside class="w-full xl:w-[280px] shrink-0 space-y-4"><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center gap-2 px-4 py-3 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-zap text-[#5136d2]" aria-hidden="true"><path d="M4 14a1 1 0 0 1-.78-1.63l9.9-10.2a.5.5 0 0 1 .86.46l-1.92 6.02A1 1 0 0 0 13 10h7a1 1 0 0 1 .78 1.63l-9.9 10.2a.5.5 0 0 1-.86-.46l1.92-6.02A1 1 0 0 0 11 14z"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Weaponization</span></div><div class="p-4 space-y-2.5"><p class="text-[11px] text-content-faint">No Nuclei template, Metasploit module or public proof-of-concept found.</p><a href="https://github.com/projectdiscovery/nuclei-templates" target="_blank" rel="noopener noreferrer" class="flex items-center justify-between gap-2 group"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-search text-content-faint shrink-0" aria-hidden="true"><path d="m21 21-4.34-4.34"></path><circle cx="11" cy="11" r="8"></circle></svg><span class="text-[12px] text-content-muted">Nuclei template</span></div><span class="text-[10px] text-content-faint">Not found</span></a><a href="https://github.com/search?q=GHSA-gw32-9rmw-qwww+repo%3Arapid7%2Fmetasploit-framework&type=code" target="_blank" rel="noopener noreferrer" class="flex items-center justify-between gap-2 group"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-bug text-content-faint shrink-0" aria-hidden="true"><path d="M12 20v-9"></path><path d="M14 7a4 4 0 0 1 4 4v3a6 6 0 0 1-12 0v-3a4 4 0 0 1 4-4z"></path><path d="M14.12 3.88 16 2"></path><path d="M21 21a4 4 0 0 0-3.81-4"></path><path d="M21 5a4 4 0 0 1-3.55 3.97"></path><path d="M22 13h-4"></path><path d="M3 21a4 4 0 0 1 3.81-4"></path><path d="M3 5a4 4 0 0 0 3.55 3.97"></path><path d="M6 13H2"></path><path d="m8 2 1.88 1.88"></path><path d="M9 7.13V6a3 3 0 1 1 6 0v1.13"></path></svg><span class="text-[12px] text-content-muted">Metasploit module</span></div><span class="text-[10px] text-content-faint">Not found</span></a></div></div><div class="rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield text-[#5136d2]" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">OpenSSF Scorecard</span></div><a href="https://securityscorecards.dev/#/projects/github.com/sveltejs/svelte" target="_blank" rel="noopener noreferrer" class="text-[10px] text-content-faint hover:text-content-subtle transition-colors">View full</a></div><div class="p-4 space-y-3"><div class="flex items-center justify-between"><div><div class="text-[11px] text-content-faint mb-0.5">Package health score</div><div class="text-[11px] font-mono text-content-subtle truncate">svelte</div></div><span class="text-[22px] font-bold tabular-nums px-3 py-1.5 rounded-xl border bg-line border-line-strong text-green-500">7.6<span class="text-[13px] font-normal opacity-60">/10</span></span></div><div class="h-1.5 rounded-full bg-line overflow-hidden"><div class="h-full rounded-full transition-all bg-green-500" style="width:76%"></div></div><div class="space-y-1.5 pt-1"><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Code-Review</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-amber-500">5/10</span></div><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Maintained</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-green-500">10/10</span></div><div class="flex items-center justify-between gap-2"><span class="text-[11px] text-content-faint truncate">Branch-Protection</span><span class="text-[11px] font-semibold tabular-nums shrink-0 text-amber-500">4/10</span></div></div><div class="text-[10px] text-content-faint pt-1">Assessed Nov 2, 2026</div></div></div><div class="rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="flex items-center gap-2 px-4 py-3 border-b border-line"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-clock text-[#5136d2]" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 6v6l4 2"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Timeline</span></div><div class="px-4 py-5 space-y-0"><div class="flex gap-3"><div class="flex flex-col items-center shrink-0" style="width:16px"><div class="w-3.5 h-3.5 rounded-full shrink-0 mt-0.5 ring-2 ring-surface-raised bg-[#5136d2]" style="box-shadow:0 0 8px #5136d288"></div><div class="w-px flex-1 mt-1" style="background:linear-gradient(to bottom, rgba(81,54,210,0.25), rgba(81,54,210,0.05));min-height:28px"></div></div><div class="pb-4  min-w-0"><div class="text-[10px] text-content-faint uppercase tracking-wider font-semibold leading-none mb-1">Disclosed</div><div class="text-[13px] font-medium text-content-muted">Jan 16, 2026</div></div></div><div class="flex gap-3"><div class="flex flex-col items-center shrink-0" style="width:16px"><div class="w-3.5 h-3.5 rounded-full shrink-0 mt-0.5 ring-2 ring-surface-raised bg-content-faint" style="box-shadow:none"></div></div><div class="pb-4 pb-0 min-w-0"><div class="text-[10px] text-content-faint uppercase tracking-wider font-semibold leading-none mb-1">Last updated</div><div class="text-[13px] font-medium text-content-muted">Feb 3, 2026</div></div></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-tag text-[#5136d2]" aria-hidden="true"><path d="M12.586 2.586A2 2 0 0 0 11.172 2H4a2 2 0 0 0-2 2v7.172a2 2 0 0 0 .586 1.414l8.704 8.704a2.426 2.426 0 0 0 3.42 0l6.58-6.58a2.426 2.426 0 0 0 0-3.42z"></path><circle cx="7.5" cy="7.5" r=".5" fill="currentColor"></circle></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Identifiers</span></div></div><div class="p-4"><div class="space-y-2"><div class="flex items-center justify-between gap-2"><code class="text-[12px] font-mono text-content-muted">GHSA-gw32-9rmw-qwww</code><button class="inline-flex items-center gap-1 px-2 py-0.5 rounded text-[11px] font-mono bg-line border border-line-strong text-content-faint hover:text-content-muted hover:bg-line-strong transition-all" title="Copy"><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg> copy</button></div></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link text-[#5136d2]" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">References</span></div><span class="text-[11px] text-content-faint">3</span></div><div class=""><div class="overflow-y-auto max-h-72 refs-scroll space-y-0.5 py-2"><a href="https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Web</span><span class="text-[12px] truncate flex-1">github.com<span class="text-content-faint"> · GHSA gw32 9rmw qwww</span></span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a><a href="https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Web</span><span class="text-[12px] truncate flex-1">github.com<span class="text-content-faint"> · a31dec5eb30978cff7ff4d77f4bf316841f711bc</span></span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a><a href="https://github.com/sveltejs/svelte" target="_blank" rel="noopener noreferrer" class="flex items-center gap-2.5 px-3 py-2 rounded-lg hover:bg-line transition-colors group text-content-faint hover:text-content-muted"><span class="shrink-0 opacity-60 group-hover:opacity-100"><svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-globe" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"></path><path d="M2 12h20"></path></svg></span><span class="text-[10px] font-semibold uppercase tracking-wider text-content-faint shrink-0 w-14">Package</span><span class="text-[12px] truncate flex-1">github.com<span class="text-content-faint"> · svelte</span></span><svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link shrink-0 opacity-0 group-hover:opacity-50" aria-hidden="true"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg></a></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-shield text-[#5136d2]" aria-hidden="true"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Related vulnerabilities</span></div></div><div class="p-4"><div class="space-y-3"><div class="space-y-1"><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-42567"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-42567</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/GHSA-f3cj-j4f6-wq85"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">GHSA-f3cj-j4f6-wq85</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-42599"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-42599</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-42573"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-42573</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-27901"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-27901</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-27902"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-27902</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-27125"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-27125</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a class="flex items-center justify-between py-1 group" href="/vulnerability/CVE-2026-27121"><span class="flex items-center gap-1.5 min-w-0"><span class="w-1.5 h-1.5 rounded-full shrink-0 bg-amber-500" title="MODERATE"></span><code class="text-[12px] font-mono text-content-faint group-hover:text-[#5136d2] transition-colors truncate">CVE-2026-27121</code></span><svg xmlns="http://www.w3.org/2000/svg" width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-arrow-right text-line-strong shrink-0 group-hover:text-[#5136d2] group-hover:translate-x-0.5 transition-all" aria-hidden="true"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a></div></div></div></div><div class="relative rounded-xl border border-line bg-surface-raised overflow-hidden"><div class="absolute inset-x-0 top-0 h-px bg-gradient-to-r from-transparent via-[#5136d2]/20 to-transparent"></div><div class="flex items-center justify-between px-4 py-3 border-b border-line"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-circle-check text-[#5136d2]" aria-hidden="true"><circle cx="12" cy="12" r="10"></circle><path d="m9 12 2 2 4-4"></path></svg><span class="text-[11px] font-semibold uppercase tracking-widest text-content-subtle">Provenance</span></div></div><div class="p-4"><div class="space-y-2.5"><div><div class="text-[10px] text-content-faint uppercase tracking-widest font-semibold mb-1">Sources</div><div class="flex flex-wrap gap-1.5"><span class="text-[11px] px-2 py-0.5 rounded-full bg-line border border-line-strong text-content-subtle">OSV.dev</span><span class="text-[11px] px-2 py-0.5 rounded-full bg-line border border-line-strong text-content-subtle">FIRST.org (EPSS)</span></div></div><div class="flex items-center justify-between border-t border-line pt-2.5"><span class="text-[10px] text-content-faint uppercase tracking-widest font-semibold">Last verified</span><span class="text-[11px] font-mono text-content-muted">Feb 3, 2026</span></div></div></div></div></aside></div></main></div><footer class="w-full bg-surface"><div class="max-w-[1400px] mx-auto px-6 lg:px-10"><div class="grid grid-cols-2 md:grid-cols-4 lg:grid-cols-8 gap-x-6 gap-y-10 py-14 border-b border-line"><nav aria-label="Develop"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Develop</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/developer-security">Developer Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/coding-agents">Coding Agents</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/ai-threat-model">AI Threat Model</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/agentic-sast">Agentic SAST</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/impact-aware-sca">Impact-Aware SCA</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/secret-scanner">Secret Scanner</a></li></ul></nav><nav aria-label="Build"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Build</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/github-actions">GitHub Actions</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/jenkins-security">Jenkins Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/workload-security">Workload Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/malware-detection">Malware Detection</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/integrations">Integrations</a></li></ul></nav><nav aria-label="Ship"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Ship</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/shift-left-pentest">Shift-left PenTest</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/image-scanning">Image Scanning</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/iac-scanning">IaC Scanning</a></li></ul></nav><nav aria-label="Run"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Run</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/agentic-dast">Agentic DAST</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/kubernetes-security">Kubernetes Security</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/egress-monitor">Egress Monitor</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/vulnerability">Vulnerability Database</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/malware-database">Malware Database</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/malware">Browse Malicious Packages</a></li></ul></nav><nav aria-label="Compliance"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5"><a class="hover:text-content-muted transition-colors" href="/compliance">Compliance</a></h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance">All frameworks</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/eu-cyber-resilience-act-cra-sbom-compliance">EU Cyber Resilience Act</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/cert-in-sbom-cbom-qbom-aibom-hbom-guidelines">CERT-In SBOM Guidelines</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/sebi-cscrf-sbom-compliance-india">SEBI CSCRF</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/compliance/executive-order-14028-nist-ssdf-attestation">EO 14028 + NIST SSDF</a></li></ul></nav><nav aria-label="BOM Suite"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5"><a class="hover:text-content-muted transition-colors" href="/bom-compliance">BOM Suite</a></h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/cryptographic-bill-of-materials">CBOM (Cryptographic)</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/software-bill-of-materials-sbom">SBOM (Software)</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/aibom">AIBOM (AI)</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/hbom">HBOM (Hardware)</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/qbom">QBOM (Quantum)</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/bom-compliance">BOM Compliance</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/license-compliance">License Compliance</a></li></ul></nav><nav aria-label="Guides"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5"><a class="hover:text-content-muted transition-colors" href="/academy">Guides</a></h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/cbom-cryptographic-bill-of-materials">What is a CBOM?</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/aibom-ai-bill-of-materials">What is an AIBOM?</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/sbom-software-bill-of-materials">What is an SBOM?</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/qbom-quantum-bill-of-materials">What is a QBOM?</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/hbom-hardware-bill-of-materials">What is an HBOM?</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy/aibom-vs-sbom">AIBOM vs SBOM</a></li></ul></nav><nav aria-label="Company"><h4 class="text-content text-[11px] font-bold uppercase tracking-[0.18em] mb-5">Company</h4><ul class="space-y-3"><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/about">About</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/careers">Careers</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/contact-us">Contact Us</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/blog">Blog</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/academy">Academy</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/supply-chain-attack-examples">Attack Examples</a></li><li><a class="text-content-muted text-[14px] hover:text-content transition-colors leading-snug" href="/glossary">Glossary</a></li></ul></nav></div><div class="flex flex-col md:flex-row md:items-center gap-8 py-10 border-b border-line"><div class="flex flex-col gap-5 md:w-[220px] shrink-0"><a class="inline-flex items-center" href="/"><img src="/images/O3-text-white.svg" alt="O3 Security" class="h-6 w-auto object-contain"/></a><ul aria-label="Social media" class="flex items-center gap-4"><li><a target="_blank" rel="noopener noreferrer" aria-label="Twitter / X" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://twitter.com/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="YouTube" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://youtube.com/@o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="LinkedIn" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://linkedin.com/company/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85 3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.062 2.062 0 01-2.063-2.065 2.063 2.063 0 112.063 2.065zm1.782 13.019H3.555V9h3.564v11.452zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0h.003z"></path></svg></a></li><li><a target="_blank" rel="noopener noreferrer" aria-label="GitHub" class="text-content-subtle hover:text-content transition-colors inline-flex" href="https://github.com/o3security"><svg class="size-[18px]" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.4 3-.405 1.02.005 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"></path></svg></a></li></ul></div><div class="hidden md:block w-px self-stretch bg-line mx-4"></div><div class="flex-1 flex items-center justify-between gap-6"><a aria-label="Trust Center: SOC 2 Type II and ISO 27001" class="flex items-center gap-6" href="/trust"><img src="/images/soc-2.svg" alt="SOC 2 Type II" title="SOC 2 Type II" class="h-16 w-auto object-contain opacity-70 hover:opacity-100 transition-opacity"/><img src="/images/iso-27001.svg" alt="ISO 27001" title="ISO 27001" class="h-16 w-auto object-contain opacity-70 hover:opacity-100 transition-opacity"/></a><div class="flex flex-wrap items-center justify-end gap-x-3 gap-y-1 text-content-subtle text-[13px]"><a class="hover:text-content transition-colors" href="/privacy">Privacy Policy</a><span class="text-content-faint">•</span><a class="hover:text-content transition-colors" href="/terms">Terms of use</a><span class="text-content-faint">•</span><a class="hover:text-content transition-colors" href="/trust">Trust Center</a><span class="text-content-faint">•</span><a class="hover:text-content transition-colors" href="/security-policy">Security</a></div></div></div><div class="py-6 border-t border-line"><div class="text-content-subtle text-[13px]"><span>© 2026 O3 Security Inc.</span><span class="ml-1 text-content-faint">All rights reserved.</span></div></div></div></footer></div><button type="button" aria-label="Open live chat" aria-busy="false" class="fixed bottom-5 right-5 z-[9999] flex h-14 w-14 items-center justify-center rounded-full bg-[#7C5CFF] text-white shadow-lg transition-transform duration-200 hover:scale-105 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-white disabled:opacity-70 motion-reduce:transition-none motion-reduce:hover:scale-100"><svg aria-hidden="true" viewBox="0 0 24 24" class="h-6 w-6" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 11.5a8.38 8.38 0 0 1-.9 3.8 8.5 8.5 0 0 1-7.6 4.7 8.38 8.38 0 0 1-3.8-.9L3 21l1.9-5.7a8.38 8.38 0 0 1-.9-3.8 8.5 8.5 0 0 1 4.7-7.6 8.38 8.38 0 0 1 3.8-.9h.5a8.48 8.48 0 0 1 8 8v.5z"></path></svg></button><script>requestAnimationFrame(function(){$RT=performance.now()});</script><script src="/_next/static/chunks/0pk7yr8ork1.d.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[865150,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"THEME_NO_FLASH_SCRIPT\"]\n3:I[969471,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"\"]\nb:I[13796,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\",1]\ne:I[865150,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"ThemeProvider\"]\nf:I[911440,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n10:I[356496,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n11:I[350094,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"NotFoundCanvas\"]\n12:I[374603,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"\"]\n13:I[793739,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0ojmo4854gmp2.js\"],\"default\"]\n14:I[843999,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n15:I[248012,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"DeferredAnalytics\"]\n16:\"$Sreact.suspense\"\n17:I[638512,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"AttributionCapture\"]\n18:I[239867,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"default\"]\n1a:I[66352,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"OutletBoundary\"]\n1d:I[66352,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"ViewportBoundary\"]\n1f:I[66352,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"MetadataBoundary\"]\n:HL[\"/_next/static/chunks/0d2_xqz2e3xyo.css\",\"style\"]\n:HL[\"/_next/static/chunks/0.fb-6oy1crsb.css\",\"style\"]\n:HL[\"/_next/static/media/47fe1b7cd6e6ed85-s.p.0~mcdl10zdfb3.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/797e433ab948586e-s.p.08e28id.o-okb.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/829ba4228c966254-s.p.0ub.k0om~_-xi.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/83afe278b6a6bb3c-s.p.0q-301v4kxxnr.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/8e6fa89aa22d24ec-s.p.0uvzar8hswo3p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/a218039a3287bcfd-s.p.17-1enzs_j91b.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/c875c6f5d3e977ac-s.p.0g_ng0t~d_b9n.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/e2334d715941921e-s.p.12skym0rqknxy.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n4:T56d,"])</script><script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"Organization\",\"@id\":\"https://o3.security/#organization\",\"name\":\"O3 Security\",\"legalName\":\"O3 Security Inc.\",\"url\":\"https://o3.security\",\"logo\":\"https://o3.security/images/O3-text-white.svg\",\"image\":\"https://o3.security/opengraph.png\",\"description\":\"O3 Security is a unified platform for software supply chain security, covering code, build pipelines and production runtime, plus the compliance artifacts regulators ask for (SBOM, CBOM, AIBOM, HBOM, QBOM).\",\"foundingDate\":\"2025\",\"email\":\"hello@o3.security\",\"subOrganization\":{\"@type\":\"Organization\",\"name\":\"MutexLock Technologies Private Limited\",\"alternateName\":\"O3 Security\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"235, Binnamangala, 2nd Floor, 13th Cross Road, 2nd Stage, Indira Nagar\",\"addressLocality\":\"Bengaluru\",\"postalCode\":\"560038\",\"addressCountry\":\"IN\"}},\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"email\":\"hello@o3.security\",\"telephone\":\"+91-70044-85204\",\"availableLanguage\":[\"en\"],\"areaServed\":[\"IN\",\"US\",\"EU\"]},{\"@type\":\"ContactPoint\",\"contactType\":\"security\",\"email\":\"hello@o3.security\",\"url\":\"https://o3.security/security-policy\"}],\"sameAs\":[\"https://www.linkedin.com/company/o3security\",\"https://twitter.com/o3security\",\"https://github.com/o3security\",\"https://www.crunchbase.com/organization/o3-security\",\"https://www.wikidata.org/wiki/Q140085379\"]}"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"c\":[\"\",\"vulnerability\",\"GHSA-gw32-9rmw-qwww\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"vulnerability\",{\"children\":[[\"cve\",\"GHSA-gw32-9rmw-qwww\",\"d\",null],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",16],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0d2_xqz2e3xyo.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0.fb-6oy1crsb.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/0muyb03.xjba2.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/0duoam7uxl~1r.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"className\":\"h-full antialiased\",\"suppressHydrationWarning\":true,\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$2\"}}],[\"$\",\"link\",null,{\"rel\":\"icon\",\"type\":\"image/png\",\"href\":\"/favicon-96x96.png\",\"sizes\":\"96x96\"}],[\"$\",\"link\",null,{\"rel\":\"icon\",\"type\":\"image/svg+xml\",\"href\":\"/favicon.svg\"}],[\"$\",\"link\",null,{\"rel\":\"shortcut icon\",\"href\":\"/favicon.ico\"}],[\"$\",\"link\",null,{\"rel\":\"apple-touch-icon\",\"sizes\":\"180x180\",\"href\":\"/apple-touch-icon.png\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"application/rss+xml\",\"title\":\"O3 Security — Blog\",\"href\":\"/feed.xml\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"LLM Context (llms.txt)\",\"href\":\"/llms.txt\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"LLM Context — full (llms-full.txt)\",\"href\":\"/llms-full.txt\"}],[\"$\",\"link\",null,{\"rel\":\"alternate\",\"type\":\"text/plain\",\"title\":\"AI Interaction Guidance (ai.txt)\",\"href\":\"/ai.txt\"}],[\"$\",\"meta\",null,{\"name\":\"apple-mobile-web-app-title\",\"content\":\"O3 Security\"}],[\"$\",\"$L3\",null,{\"id\":\"ms-clarity\",\"strategy\":\"lazyOnload\",\"children\":\"(function(c,l,a,r,i,t,y){\\n              c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};\\n              t=l.createElement(r);t.async=1;t.src=\\\"https://www.clarity.ms/tag/\\\"+i;\\n              y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);\\n          })(window, document, \\\"clarity\\\", \\\"script\\\", \\\"x0c1wkg19t\\\");\"}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$4\"}}],[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"WebSite\\\",\\\"@id\\\":\\\"https://o3.security/#website\\\",\\\"name\\\":\\\"O3 Security\\\",\\\"url\\\":\\\"https://o3.security\\\",\\\"description\\\":\\\"O3 traces every supply chain attack from the line of code that introduced it to the exploit in production — code, build, runtime, one platform, zero gaps.\\\",\\\"inLanguage\\\":\\\"en\\\",\\\"publisher\\\":{\\\"@id\\\":\\\"https://o3.security/#organization\\\"},\\\"potentialAction\\\":{\\\"@type\\\":\\\"SearchAction\\\",\\\"target\\\":\\\"https://o3.security/?q={search_term_string}\\\",\\\"query-input\\\":\\\"required name=search_term_string\\\"}}\"}}]]}],\"$L5\"]}]]}],{\"children\":[\"$L6\",{\"children\":[\"$L7\",{\"children\":[\"$L8\",{},null,false,null]},null,false,\"$@9\"]},null,false,\"$@9\"]},null,false,null],\"$La\",false]],\"m\":\"$undefined\",\"G\":[\"$b\",[\"$Lc\",\"$Ld\"]],\"S\":false,\"h\":null,\"s\":\"$undefined\",\"l\":\"$undefined\",\"p\":\"$undefined\",\"d\":\"$undefined\",\"b\":\"Z8vrTd076lDQWxJO0aI0_\"}\n"])</script><script>self.__next_f.push([1,"5:[\"$\",\"body\",null,{\"className\":\"poppins_dc75922d-module__nm-FiW__className geist_mono_8d43a2aa-module__8Li5zG__variable inter_ce929fb-module__qqrwVG__variable min-h-full flex flex-col\",\"children\":[[\"$\",\"$Le\",null,{\"children\":[\"$\",\"$Lf\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L10\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"div\",null,{\"className\":\"relative min-h-screen bg-surface text-content flex flex-col items-center justify-center px-6 text-center overflow-hidden\",\"children\":[[\"$\",\"$L11\",null,{}],[\"$\",\"div\",null,{\"className\":\"absolute bottom-0 inset-x-0 h-32 pointer-events-none\",\"style\":{\"background\":\"linear-gradient(to bottom, transparent, #000)\"}}],[\"$\",\"div\",null,{\"className\":\"relative z-10 flex flex-col items-center\",\"children\":[[\"$\",\"div\",null,{\"className\":\"inline-flex items-center gap-2 bg-surface-raised border border-line rounded-full px-4 py-1.5 mb-8\",\"children\":[[\"$\",\"span\",null,{\"className\":\"w-1.5 h-1.5 rounded-full bg-accent animate-pulse\"}],[\"$\",\"span\",null,{\"className\":\"text-[11px] font-bold uppercase tracking-[0.2em] text-accent\",\"children\":\"Scan in progress\"}]]}],[\"$\",\"h1\",null,{\"className\":\"text-5xl md:text-7xl font-bold tracking-tighter leading-none mb-2 text-content\",\"children\":\"Lost in space.\"}],[\"$\",\"p\",null,{\"className\":\"text-xl md:text-2xl font-medium text-content-subtle tracking-tight mb-6\",\"children\":\"This page doesn't exist.\"}],[\"$\",\"p\",null,{\"className\":\"text-content-muted text-base max-w-sm mb-2 leading-relaxed\",\"children\":\"But while you're drifting out here —\"}],[\"$\",\"p\",null,{\"className\":\"text-content text-lg md:text-xl font-semibold max-w-lg mb-10 leading-snug text-balance\",\"children\":[\"we probably found\",\" \",[\"$\",\"span\",null,{\"className\":\"text-accent\",\"children\":\"17 vulnerabilities\"}],\" \",\"in your supply chain.\",[\"$\",\"br\",null,{}],[\"$\",\"span\",null,{\"className\":\"text-content-subtle text-base font-normal\",\"children\":\"Want to check?\"}]]}],[\"$\",\"div\",null,{\"className\":\"flex flex-col sm:flex-row items-center gap-3 mb-16\",\"children\":[[\"$\",\"$L12\",null,{\"href\":\"/\",\"className\":\"px-5 h-10 flex items-center gap-2 rounded-lg bg-primary text-primary-foreground font-semibold text-sm hover:scale-[1.02] active:scale-95 transition-all group\",\"children\":[\"Back to safety\",[\"$\",\"$L13\",null,{\"ref\":\"$undefined\",\"iconNode\":[[\"path\",{\"d\":\"m9 18 6-6-6-6\",\"key\":\"mthhwq\"}]],\"className\":\"lucide-chevron-right w-4 h-4 group-hover:translate-x-0.5 transition-transform\"}]]}],[\"$\",\"$L12\",null,{\"href\":\"/software-bill-of-materials-sbom\",\"className\":\"px-5 h-10 flex items-center rounded-lg border border-line-strong text-content font-medium text-sm hover:bg-content/[0.06] transition-all hover:scale-[1.02] active:scale-95\",\"children\":\"Scan my supply chain →\"}]]}],[\"$\",\"div\",null,{\"className\":\"flex flex-wrap justify-center gap-x-6 gap-y-2 text-content-faint text-xs\",\"children\":[[\"$\",\"$L12\",\"/code-shield\",{\"href\":\"/code-shield\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"CodeShield\"}],[\"$\",\"$L12\",\"/agentic-sast\",{\"href\":\"/agentic-sast\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Agentic SAST\"}],[\"$\",\"$L12\",\"/agentic-dast\",{\"href\":\"/agentic-dast\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Agentic DAST\"}],[\"$\",\"$L12\",\"/impact-aware-sca\",{\"href\":\"/impact-aware-sca\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Impact-Aware SCA\"}],[\"$\",\"$L12\",\"/quantum-readiness\",{\"href\":\"/quantum-readiness\",\"className\":\"hover:text-content-subtle transition-colors\",\"children\":\"Quantum Readiness\"}]]}]]}]]}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}],[\"$\",\"$L14\",null,{}],[\"$\",\"$L15\",null,{\"gaId\":\"G-KF4FC3MH7X\"}],[\"$\",\"$16\",null,{\"fallback\":null,\"children\":[\"$\",\"$L17\",null,{}]}],[\"$\",\"$L18\",null,{}]]}]\n"])</script><script>self.__next_f.push([1,"6:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$Lf\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L10\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n7:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$Lf\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L10\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n8:[\"$\",\"$1\",\"c\",{\"children\":[\"$L19\",[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/0.auzk3.ehvx2.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/0rjqr_md8culd.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-2\",{\"src\":\"/_next/static/chunks/0azapa4~xcf~c.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-3\",{\"src\":\"/_next/static/chunks/0u5u3k0-wcwbi.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-4\",{\"src\":\"/_next/static/chunks/0_uwt9vn84ub4.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-5\",{\"src\":\"/_next/static/chunks/0caxi587~hsdo.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L1a\",null,{\"children\":[\"$\",\"$16\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@1b\"}]}]]}]\n1c:[]\n9:\"$W1c\"\na:[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L1d\",null,{\"children\":\"$L1e\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L1f\",null,{\"children\":[\"$\",\"$16\",null,{\"name\":\"Next.Metadata\",\"children\":\"$L20\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}]\nc:[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0d2_xqz2e3xyo.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]\nd:[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/0.fb-6oy1crsb.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]\n1e:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"2\",{\"name\":\"theme-color\",\"content\":\"#030616\",\"media\":\"(prefers-color-scheme: dark)\"}],[\"$\",\"meta\",\"3\",{\"name\":\"theme-color\",\"content\":\"#ffffff\",\"media\":\"(prefers-color-scheme: light)\"}],[\"$\",\"meta\",\"4\",{\"name\":\"color-scheme\",\"content\":\"dark\"}]]\n"])</script><script>self.__next_f.push([1,"21:T6b2,"])</script><script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"Article\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#article\",\"headline\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value\",\"description\":\"Summary: A server-side rendered \u003ctextarea\u003e with two-way bound value does not have its value correctly escaped in the rendered HTML. Details: In SSR, \u003ctextarea bind:value={...}\u003e does not have its value escaped when it is rendered into the HTML as \u003ctextarea\u003e...\u003c/textarea\u003e. PoC: Put this in a server-side-rendered Svelte component: \u003cscript\u003e let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`; \u003c/script\u003e \u003ctextarea bind:value /\u003eImpact: Only affects SSR Needs a \u003ctextarea bind:value\u003e\",\"image\":\"https://o3.security/opengraph.png\",\"datePublished\":\"2026-01-16T21:02:56Z\",\"dateModified\":\"2026-02-03T03:17:01.517258Z\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\",\"inLanguage\":\"en\",\"author\":{\"@id\":\"https://o3.security/#organization\"},\"publisher\":{\"@id\":\"https://o3.security/#organization\"},\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"},\"speakable\":{\"@type\":\"SpeakableSpecification\",\"cssSelector\":[\"h1\",\".vuln-summary\",\".vuln-severity\",\".vuln-mitigation\"]},\"about\":[{\"@type\":\"SoftwareApplication\",\"name\":\"svelte\",\"applicationCategory\":\"npm\",\"softwareVersion\":\"3.59.2\"}],\"citation\":[{\"@type\":\"CreativeWork\",\"name\":\"OSV.dev\",\"url\":\"https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww\"},{\"@type\":\"CreativeWork\",\"url\":\"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww\"},{\"@type\":\"CreativeWork\",\"url\":\"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc\"}]}"])</script><script>self.__next_f.push([1,"22:T4e0,{\"@context\":\"https://schema.org\",\"@type\":\"Dataset\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#record\",\"name\":\"GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value\",\"description\":\"Summary: A server-side rendered \u003ctextarea\u003e with two-way bound value does not have its value correctly escaped in the rendered HTML. Details: In SSR, \u003ctextarea bind:value={...}\u003e does not have its value escaped when it is rendered into the HTML as \u003ctextarea\u003e...\u003c/textarea\u003e. PoC: Put this in a server-side-rendered Svelte component: \u003cscript\u003e let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`; \u003c/script\u003e \u003ctextarea bind:value /\u003eImpact: Only affects SSR Needs a \u003ctextarea bind:value\u003e\",\"url\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\",\"identifier\":\"GHSA-gw32-9rmw-qwww\",\"datePublished\":\"2026-01-16T21:02:56Z\",\"dateModified\":\"2026-02-03T03:17:01.517258Z\",\"inLanguage\":\"en\",\"license\":\"https://creativecommons.org/licenses/by/4.0/\",\"keywords\":[\"GHSA-gw32-9rmw-qwww\",\"CVE\",\"vulnerability\",\"security advisory\"],\"creator\":{\"@id\":\"https://o3.security/#organization\"},\"isAccessibleForFree\":true,\"citation\":[{\"@type\":\"CreativeWork\",\"name\":\"OSV.dev\",\"url\":\"https://osv.dev/vulnerability/GHSA-gw32-9rmw-qwww\"}]}19:[[[\"$\",\"script\",\"0\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"BreadcrumbList\\\",\\\"itemListElement\\\":[{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":1,\\\"name\\\":\\\"Home\\\",\\\"item\\\":\\\"https://o3.security\\\"},{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":2,\\\"name\\\":\\\"Vulnerability Database\\\",\\\"item\\\":\\\"https://o3.security/vulnerability\\\"},{\\\"@type\\\":\\\"ListItem\\\",\\\"position\\\":3,\\\"name\\\":\\\"GHSA-gw32-9rmw-qwww\\\",\\\"item\\\":\\\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\\\"}]}\"}}],[\"$\",\"script\",\"1\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$21\"}}],[\"$\",\"script\",\"2\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$22\"}}],\"$L23\"],\"$L24\"]\n"])</script><script>self.__next_f.push([1,"26:I[651326,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\",\"/_next/static/chunks/0.auzk3.ehvx2.js\",\"/_next/static/chunks/0rjqr_md8culd.js\",\"/_next/static/chunks/0azapa4~xcf~c.js\",\"/_next/static/chunks/0u5u3k0-wcwbi.js\",\"/_next/static/chunks/0_uwt9vn84ub4.js\",\"/_next/static/chunks/0caxi587~hsdo.js\"],\"default\"]\n25:Tc89,"])</script><script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@type\":\"FAQPage\",\"@id\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww#faq\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\"}},{\"@type\":\"Question\",\"name\":\"How severe is GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure.\"}},{\"@type\":\"Question\",\"name\":\"Which packages are affected by GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm.\"}},{\"@type\":\"Question\",\"name\":\"How do I fix GHSA-gw32-9rmw-qwww?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\"}},{\"@type\":\"Question\",\"name\":\"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.\"}},{\"@type\":\"Question\",\"name\":\"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\"}},{\"@type\":\"Question\",\"name\":\"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.\"}},{\"@type\":\"Question\",\"name\":\"When was GHSA-gw32-9rmw-qwww published, and has it been updated?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.\"}}]}"])</script><script>self.__next_f.push([1,"23:[\"$\",\"script\",\"3\",{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$25\"}}]\n"])</script><script>self.__next_f.push([1,"24:[\"$\",\"$L26\",null,{\"vuln\":{\"id\":\"GHSA-gw32-9rmw-qwww\",\"summary\":\"svelte is vulnerable to XSS with textarea bind:value\",\"details\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\",\"modified\":\"2026-02-03T03:17:01.517258Z\",\"published\":\"2026-01-16T21:02:56Z\",\"database_specific\":{\"cwe_ids\":[\"CWE-79\"],\"severity\":\"HIGH\",\"github_reviewed\":true,\"github_reviewed_at\":\"2026-01-16T21:02:56Z\",\"nvd_published_at\":null},\"references\":[{\"type\":\"WEB\",\"url\":\"https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww\"},{\"type\":\"WEB\",\"url\":\"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc\"},{\"type\":\"PACKAGE\",\"url\":\"https://github.com/sveltejs/svelte\"}],\"affected\":[{\"package\":{\"name\":\"svelte\",\"ecosystem\":\"npm\",\"purl\":\"pkg:npm/svelte\"},\"ranges\":[{\"type\":\"SEMVER\",\"events\":[{\"introduced\":\"3.0.0\"},{\"fixed\":\"3.59.2\"}]}],\"database_specific\":{\"source\":\"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-gw32-9rmw-qwww/GHSA-gw32-9rmw-qwww.json\"}}],\"schema_version\":\"1.9.0\",\"severity\":[{\"type\":\"CVSS_V4\",\"score\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N\"}]},\"cvss\":null,\"affected\":[\"$24:props:vuln:affected:0\"],\"faqs\":[{\"question\":\"What is GHSA-gw32-9rmw-qwww?\",\"answer\":\"### Summary\\n\\nA server-side rendered `\u003ctextarea\u003e` with two-way bound value does not have its value correctly escaped in the rendered HTML.\\n\\n### Details\\n\\nIn SSR, `\u003ctextarea bind:value={...}\u003e` does not have its value escaped when it is rendered into the HTML as `\u003ctextarea\u003e...\u003c/textarea\u003e`.\\n\\n### PoC\\n\\nPut this in a server-side-rendered Svelte component:\\n\\n```\\n\u003cscript\u003e\\n  let value = `test'\\\"\u003e\u003c/textarea\u003e\u003cscript` + `\u003ealert('BIM');\u003c/sc` + `ript\u003e`;\\n\u003c/script\u003e\\n\\n\u003ctextarea bind:value /\u003e\\n```\\n\\n### Impact\\n\\n- Only affects SSR\\n- Needs a `\u003ctextarea bind:value\u003e` filled by user content via two-way binding\"},{\"question\":\"How severe is GHSA-gw32-9rmw-qwww?\",\"answer\":\"No CVSS score has been assigned to GHSA-gw32-9rmw-qwww yet. Review the advisory details and affected package list to assess your exposure.\"},{\"question\":\"Which packages are affected by GHSA-gw32-9rmw-qwww?\",\"answer\":\"GHSA-gw32-9rmw-qwww affects the following packages: svelte (npm). Ecosystems affected: npm.\"},{\"question\":\"How do I fix GHSA-gw32-9rmw-qwww?\",\"answer\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\"},{\"question\":\"How do I detect GHSA-gw32-9rmw-qwww in my npm dependencies?\",\"answer\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.\"},{\"question\":\"How do I mitigate GHSA-gw32-9rmw-qwww if there is no patch (or I can't update yet)?\",\"answer\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\"},{\"question\":\"Is GHSA-gw32-9rmw-qwww actively exploited in the wild?\",\"answer\":\"No public exploit code has been indexed for GHSA-gw32-9rmw-qwww yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.\"},{\"question\":\"When was GHSA-gw32-9rmw-qwww published, and has it been updated?\",\"answer\":\"GHSA-gw32-9rmw-qwww was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.\"}],\"cveId\":\"GHSA-gw32-9rmw-qwww\",\"exploits\":{\"total\":0,\"offensiveSecurity\":[],\"inTheWild\":[],\"github\":[]},\"epss\":null,\"kev\":null,\"scorecard\":{\"date\":\"2026-11-02\",\"repo\":{\"name\":\"github.com/sveltejs/svelte\",\"commit\":\"7775f73b7cbe32de3bb566f3515113208887e961\"},\"scorecard\":{\"version\":\"v5.6.0\",\"commit\":\"61e84743356275f6ffca23b1b2f2cb945e19eb96\"},\"score\":7.6,\"checks\":[{\"name\":\"Code-Review\",\"score\":5,\"reason\":\"Found 15/27 approved changesets -- score normalized to 5\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#code-review\",\"short\":\"Determines if the project requires human code review before pull requests (aka merge requests) are merged.\"}},{\"name\":\"Maintained\",\"score\":10,\"reason\":\"30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#maintained\",\"short\":\"Determines if the project is \\\"actively maintained\\\".\"}},{\"name\":\"Packaging\",\"score\":-1,\"reason\":\"packaging workflow not detected\",\"details\":[\"Warn: no GitHub/GitLab publishing workflow detected.\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#packaging\",\"short\":\"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.\"}},{\"name\":\"Dangerous-Workflow\",\"score\":10,\"reason\":\"no dangerous workflow patterns detected\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#dangerous-workflow\",\"short\":\"Determines if the project's GitHub Action workflows avoid dangerous patterns.\"}},{\"name\":\"Token-Permissions\",\"score\":10,\"reason\":\"GitHub workflow tokens follow principle of least privilege\",\"details\":[\"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/autofix.yml:13\",\"Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/autofix.yml:14\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/ci.yml:1\",\"Info: jobLevel 'actions' permission set to 'read': .github/workflows/ecosystem-ci-trigger.yml:16\",\"Info: jobLevel 'contents' permission set to 'read': .github/workflows/ecosystem-ci-trigger.yml:17\",\"Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:19\",\"Info: found token with 'none' permissions: .github/workflows/autofix.yml:1\",\"Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:7\",\"Info: found token with 'none' permissions: .github/workflows/ecosystem-ci-trigger.yml:1\",\"Info: found token with 'none' permissions: .github/workflows/release.yml:1\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#token-permissions\",\"short\":\"Determines if the project's workflows follow the principle of least privilege.\"}},{\"name\":\"CII-Best-Practices\",\"score\":0,\"reason\":\"no effort to earn an OpenSSF best practices badge detected\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#cii-best-practices\",\"short\":\"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.\"}},{\"name\":\"License\",\"score\":10,\"reason\":\"license file detected\",\"details\":[\"Info: project has a license file: LICENSE.md:0\",\"Info: FSF or OSI recognized license: MIT License: LICENSE.md:0\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#license\",\"short\":\"Determines if the project has defined a license.\"}},{\"name\":\"Pinned-Dependencies\",\"score\":10,\"reason\":\"all dependencies are pinned\",\"details\":[\"Info:  14 out of  14 GitHub-owned GitHubAction dependencies pinned\",\"Info:   3 out of   3 third-party GitHubAction dependencies pinned\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#pinned-dependencies\",\"short\":\"Determines if the project has declared and pinned the dependencies of its build process.\"}},{\"name\":\"Binary-Artifacts\",\"score\":10,\"reason\":\"no binaries found in the repo\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#binary-artifacts\",\"short\":\"Determines if the project has generated executable (binary) artifacts in the source repository.\"}},{\"name\":\"Signed-Releases\",\"score\":-1,\"reason\":\"no releases found\",\"details\":null,\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#signed-releases\",\"short\":\"Determines if the project cryptographically signs release artifacts.\"}},{\"name\":\"Security-Policy\",\"score\":10,\"reason\":\"security policy file detected\",\"details\":[\"Info: security policy file detected: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found linked content: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/sveltejs/.github/SECURITY.md:1\",\"Info: Found text in security policy: github.com/sveltejs/.github/SECURITY.md:1\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#security-policy\",\"short\":\"Determines if the project has published a security policy.\"}},{\"name\":\"Branch-Protection\",\"score\":4,\"reason\":\"branch protection is not maximal on development and all release branches\",\"details\":[\"Info: 'allow deletion' disabled on branch 'main'\",\"Info: 'force pushes' disabled on branch 'main'\",\"Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'\",\"Warn: 'stale review dismissal' is disabled on branch 'main'\",\"Warn: required approving review count is 1 on branch 'main'\",\"Warn: codeowners review is not required on branch 'main'\",\"Warn: 'last push approval' is disabled on branch 'main'\",\"Warn: 'up-to-date branches' is disabled on branch 'main'\",\"Info: status check found to merge onto on branch 'main'\",\"Info: PRs are required in order to make changes on branch 'main'\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#branch-protection\",\"short\":\"Determines if the default and release branches are protected with GitHub's branch protection settings.\"}},{\"name\":\"Fuzzing\",\"score\":0,\"reason\":\"project is not fuzzed\",\"details\":[\"Warn: no fuzzer integrations found\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#fuzzing\",\"short\":\"Determines if the project uses fuzzing.\"}},{\"name\":\"SAST\",\"score\":7,\"reason\":\"SAST tool is not run on all commits -- score normalized to 7\",\"details\":[\"Warn: 21 commits out of 30 are checked with a SAST tool\"],\"documentation\":{\"url\":\"https://github.com/ossf/scorecard/blob/61e84743356275f6ffca23b1b2f2cb945e19eb96/docs/checks.md#sast\",\"short\":\"Determines if the project uses static code analysis.\"}}]},\"nvd\":null,\"packageDownloads\":{\"svelte\":{\"weeklyDownloads\":9347187,\"ecosystem\":\"npm\"}},\"nuclei\":{\"hasTemplate\":false},\"metasploit\":{\"hasModule\":false,\"count\":0},\"attackerKb\":null,\"mitigation\":{\"detect\":\"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for svelte, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.\",\"fix\":\"Update svelte to 3.59.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw32-9rmw-qwww is resolved across your whole dependency graph.\",\"workaround\":\"If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.\"},\"archetype\":\"oss\",\"hasFix\":true,\"relatedGroups\":[{\"label\":\"Also affects svelte\",\"kind\":\"package\",\"ids\":[\"CVE-2026-42567\",\"GHSA-f3cj-j4f6-wq85\",\"CVE-2026-42599\",\"CVE-2026-42573\",\"CVE-2026-27901\",\"CVE-2026-27902\",\"CVE-2026-27125\",\"CVE-2026-27121\"],\"severities\":{\"CVE-2026-42567\":\"MODERATE\",\"GHSA-f3cj-j4f6-wq85\":\"MODERATE\",\"CVE-2026-42599\":\"MODERATE\",\"CVE-2026-42573\":\"MODERATE\",\"CVE-2026-27901\":\"MODERATE\",\"CVE-2026-27902\":\"MODERATE\",\"CVE-2026-27125\":\"MODERATE\",\"CVE-2026-27121\":\"MODERATE\"},\"comparisonNote\":\"$undefined\"}],\"answerLead\":\"GHSA-gw32-9rmw-qwww is a security vulnerability in svelte. A fix is available for svelte — see the affected versions and patch details below.\",\"headingSubject\":\"svelte\",\"fixLink\":{\"url\":\"https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc\",\"label\":\"sveltejs/svelte@a31dec5\"},\"provenance\":{\"sources\":[\"OSV.dev\",\"FIRST.org (EPSS)\"],\"lastVerified\":\"2026-02-03T03:17:01.517258Z\"},\"ssvc\":null,\"npmDependents\":{\"count\":2177},\"redHatAdvisory\":null,\"ubuntuAdvisory\":null,\"epssDist\":[],\"epssBand\":null}]\n"])</script><script>self.__next_f.push([1,"1b:null\n"])</script><script>self.__next_f.push([1,"20:[[\"$\",\"title\",\"0\",{\"children\":\"svelte is vulnerable to XSS with textarea bind:value\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…\"}],[\"$\",\"meta\",\"2\",{\"name\":\"application-name\",\"content\":\"O3 Security\"}],[\"$\",\"link\",\"3\",{\"rel\":\"author\",\"href\":\"https://o3.security\"}],[\"$\",\"meta\",\"4\",{\"name\":\"author\",\"content\":\"O3 Security\"}],[\"$\",\"link\",\"5\",{\"rel\":\"manifest\",\"href\":\"/site.webmanifest\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"meta\",\"6\",{\"name\":\"keywords\",\"content\":\"GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww vulnerability,GHSA-gw32-9rmw-qwww CVE details,GHSA-gw32-9rmw-qwww affected packages,GHSA-gw32-9rmw-qwww affected versions,GHSA-gw32-9rmw-qwww fix,GHSA-gw32-9rmw-qwww patch,GHSA-gw32-9rmw-qwww remediation,GHSA-gw32-9rmw-qwww exploit,is GHSA-gw32-9rmw-qwww exploitable,how to fix GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww CVSS,svelte vulnerability,npm security,CVE vulnerability details,open source security,supply chain vulnerability,O3 Security scanner\"}],[\"$\",\"meta\",\"7\",{\"name\":\"creator\",\"content\":\"O3 Security\"}],[\"$\",\"meta\",\"8\",{\"name\":\"publisher\",\"content\":\"O3 Security Inc.\"}],[\"$\",\"meta\",\"9\",{\"name\":\"robots\",\"content\":\"noindex, follow\"}],[\"$\",\"meta\",\"10\",{\"name\":\"category\",\"content\":\"Cybersecurity\"}],[\"$\",\"link\",\"11\",{\"rel\":\"canonical\",\"href\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"}],[\"$\",\"link\",\"12\",{\"rel\":\"alternate\",\"type\":\"application/json\",\"href\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww/data\"}],[\"$\",\"meta\",\"13\",{\"name\":\"mobile-web-app-capable\",\"content\":\"yes\"}],[\"$\",\"meta\",\"14\",{\"name\":\"apple-mobile-web-app-title\",\"content\":\"O3 Security\"}],[\"$\",\"meta\",\"15\",{\"name\":\"apple-mobile-web-app-status-bar-style\",\"content\":\"default\"}],[\"$\",\"meta\",\"16\",{\"property\":\"og:title\",\"content\":\"svelte is vulnerable to XSS with textarea bind:value\"}],[\"$\",\"meta\",\"17\",{\"property\":\"og:description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…\"}],[\"$\",\"meta\",\"18\",{\"property\":\"og:url\",\"content\":\"https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww\"}],[\"$\",\"meta\",\"19\",{\"property\":\"og:image\",\"content\":\"https://o3.security/opengraph.png\"}],[\"$\",\"meta\",\"20\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"21\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"22\",{\"property\":\"og:image:alt\",\"content\":\"GHSA-gw32-9rmw-qwww vulnerability details — O3 Security\"}],[\"$\",\"meta\",\"23\",{\"property\":\"og:type\",\"content\":\"article\"}],[\"$\",\"meta\",\"24\",{\"property\":\"article:published_time\",\"content\":\"2026-01-16T21:02:56Z\"}],[\"$\",\"meta\",\"25\",{\"property\":\"article:modified_time\",\"content\":\"2026-02-03T03:17:01.517258Z\"}],[\"$\",\"meta\",\"26\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"27\",{\"name\":\"twitter:site\",\"content\":\"@o3security\"}],[\"$\",\"meta\",\"28\",{\"name\":\"twitter:creator\",\"content\":\"@mutex\"}],[\"$\",\"meta\",\"29\",{\"name\":\"twitter:title\",\"content\":\"svelte is vulnerable to XSS with textarea bind:value\"}],[\"$\",\"meta\",\"30\",{\"name\":\"twitter:description\",\"content\":\"GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…\"}],[\"$\",\"meta\",\"31\",{\"name\":\"twitter:image\",\"content\":\"https://o3.security/opengraph.png\"}],[\"$\",\"meta\",\"32\",{\"name\":\"twitter:image:alt\",\"content\":\"GHSA-gw32-9rmw-qwww vulnerability details — O3 Security\"}],[\"$\",\"meta\",\"33\",{\"name\":\"twitter:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"34\",{\"name\":\"twitter:image:height\",\"content\":\"630\"}],[\"$\",\"link\",\"35\",{\"rel\":\"shortcut icon\",\"href\":\"/favicon.ico\"}],[\"$\",\"link\",\"36\",{\"rel\":\"icon\",\"href\":\"/favicon.ico?favicon.0t73vdlmfqa-9.ico\",\"sizes\":\"48x48\",\"type\":\"image/x-icon\"}],[\"$\",\"link\",\"37\",{\"rel\":\"icon\",\"href\":\"/favicon-96x96.png\",\"sizes\":\"96x96\",\"type\":\"image/png\"}],[\"$\",\"link\",\"38\",{\"rel\":\"icon\",\"href\":\"/favicon.svg\",\"type\":\"image/svg+xml\"}],\"$L27\",\"$L28\",\"$L29\"]\n"])</script><script>self.__next_f.push([1,"2a:I[496150,[\"/_next/static/chunks/0muyb03.xjba2.js\",\"/_next/static/chunks/0duoam7uxl~1r.js\"],\"IconMark\"]\n27:[\"$\",\"link\",\"39\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\"}]\n28:[\"$\",\"link\",\"40\",{\"rel\":\"apple-touch-icon\",\"href\":\"/apple-touch-icon.png\",\"sizes\":\"180x180\"}]\n29:[\"$\",\"$L2a\",\"41\",{}]\n"])</script><title>svelte is vulnerable to XSS with textarea bind:value</title><meta name="description" content="GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…"/><meta name="application-name" content="O3 Security"/><link rel="author" href="https://o3.security"/><meta name="author" content="O3 Security"/><link rel="manifest" href="/site.webmanifest"/><meta name="keywords" content="GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww vulnerability,GHSA-gw32-9rmw-qwww CVE details,GHSA-gw32-9rmw-qwww affected packages,GHSA-gw32-9rmw-qwww affected versions,GHSA-gw32-9rmw-qwww fix,GHSA-gw32-9rmw-qwww patch,GHSA-gw32-9rmw-qwww remediation,GHSA-gw32-9rmw-qwww exploit,is GHSA-gw32-9rmw-qwww exploitable,how to fix GHSA-gw32-9rmw-qwww,GHSA-gw32-9rmw-qwww CVSS,svelte vulnerability,npm security,CVE vulnerability details,open source security,supply chain vulnerability,O3 Security scanner"/><meta name="creator" content="O3 Security"/><meta name="publisher" content="O3 Security Inc."/><meta name="robots" content="noindex, follow"/><meta name="category" content="Cybersecurity"/><link rel="canonical" href="https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww"/><link rel="alternate" type="application/json" href="https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww/data"/><meta name="mobile-web-app-capable" content="yes"/><meta name="apple-mobile-web-app-title" content="O3 Security"/><meta name="apple-mobile-web-app-status-bar-style" content="default"/><meta property="og:title" content="svelte is vulnerable to XSS with textarea bind:value"/><meta property="og:description" content="GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…"/><meta property="og:url" content="https://o3.security/vulnerability/GHSA-gw32-9rmw-qwww"/><meta property="og:image" content="https://o3.security/opengraph.png"/><meta property="og:image:width" content="1200"/><meta property="og:image:height" content="630"/><meta property="og:image:alt" content="GHSA-gw32-9rmw-qwww vulnerability details — O3 Security"/><meta property="og:type" content="article"/><meta property="article:published_time" content="2026-01-16T21:02:56Z"/><meta property="article:modified_time" content="2026-02-03T03:17:01.517258Z"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:site" content="@o3security"/><meta name="twitter:creator" content="@mutex"/><meta name="twitter:title" content="svelte is vulnerable to XSS with textarea bind:value"/><meta name="twitter:description" content="GHSA-gw32-9rmw-qwww is a security vulnerability. It affects svelte. Patched in 3.59.2. svelte is vulnerable to XSS with textarea bind:value See affected…"/><meta name="twitter:image" content="https://o3.security/opengraph.png"/><meta name="twitter:image:alt" content="GHSA-gw32-9rmw-qwww vulnerability details — O3 Security"/><meta name="twitter:image:width" content="1200"/><meta name="twitter:image:height" content="630"/><link rel="shortcut icon" href="/favicon.ico"/><link rel="icon" href="/favicon.ico?favicon.0t73vdlmfqa-9.ico" sizes="48x48" type="image/x-icon"/><link rel="icon" href="/favicon-96x96.png" sizes="96x96" type="image/png"/><link rel="icon" href="/favicon.svg" type="image/svg+xml"/><link rel="icon" href="/favicon.ico"/><link rel="apple-touch-icon" href="/apple-touch-icon.png" sizes="180x180"/><script >document.querySelectorAll('body link[rel="icon"], body link[rel="apple-touch-icon"]').forEach(el => document.head.appendChild(el))</script><div style="display:none" id="S:1"></div><script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0};
$RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:1","S:1")</script><div style="display:none" id="S:0"></div><script>$RC("B:0","S:0")</script></body></html>