CVE-2026-42573 is a cross-site scripting (XSS) vulnerability in the Svelte web framework. The issue arises from improper neutralization of input during web page generation, specifically allowing DOM clobbering of Svelte's internal framework state on elements. This vulnerability affects all versions before 5.55.7 and has been fixed in version 5.55.7. The CVSS 4.0 base score is 5.3, indicating a medium severity level. The vulnerability requires network access, has high attack complexity, and partial impact on confidentiality and integrity. No known exploits are reported in the wild. The vendor advisory from Red Hat confirms the vulnerability and the fix but does not provide additional remediation details.

Successful exploitation of this vulnerability could allow an attacker to perform cross-site scripting attacks by manipulating the DOM and clobbering internal framework state, potentially leading to unauthorized script execution in the context of the affected web application. This can compromise the confidentiality and integrity of user interactions with the application. The impact is rated medium severity with partial confidentiality and integrity impact and no availability impact.

A fix is available in Svelte version 5.55.7. Users and developers should upgrade to version 5.55.7 or later to remediate this vulnerability. The vendor advisory does not indicate any alternative mitigations or that no action is required. Therefore, upgrading is the recommended remediation.