CVE-2026-45346: Svelte Unsanitized Html Directive Xss

Svelte's {@html ...} directive renders raw HTML/SVG verbatim and bypasses Svelte's automatic escaping. In an SVG pan/zoom component the `svg` value typically originates from chat / message content that an authenticated user (or an AI prompted by such a user) can influence. Because SVG legally embeds <foreignObject>, inline event handlers, and <script>, passi

Provally CuratedPublic repositoryHighHigh confidenceVerifiedApache-2.0Generic
greprules fetch cve-2026-45346-svelte-unsanitized-html-directive-xss --engine opengrep

Description

Svelte's {@html ...} directive renders raw HTML/SVG verbatim and bypasses Svelte's automatic escaping. In an SVG pan/zoom component the `svg` value typically originates from chat / message content that an authenticated user (or an AI prompted by such a user) can influence. Because SVG legally embeds <foreignObject>, inline event handlers, and <script>, passi