{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42573.json" } ], "title": "svelte: Svelte: Cross-Site Scripting via DOM Clobbering", "tracking": { "current_release_date": "2026-06-30T03:57:44+00:00", "generator": { "date": "2026-06-30T03:57:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-42573", "initial_release_date": "2026-06-09T16:21:29.313000+00:00", "revision_history": [ { "date": "2026-06-09T16:21:29.313000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-23T08:08:35+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T03:57:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Build of Podman Desktop", "product": { "name": "Red Hat Build of Podman Desktop", "product_id": "red_hat_build_of_podman_desktop", "product_identification_helper": { "cpe": "cpe:/a:redhat:podman_desktop:1" } } } ], "category": "product_family", "name": "Red Hat Build of Podman Desktop" }, { "category": "product_version", "name": "rh-podman-desktop.git", "product": { "name": "rh-podman-desktop.git", "product_id": "rh-podman-desktop.git", "product_identification_helper": { "purl": "pkg:npm/rh-podman-desktop.git?vcs_url=https://gitlab.cee.redhat.com/red-hat-desktop/rh-podman-desktop.git" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-podman-desktop.git as a component of Red Hat Build of Podman Desktop", "product_id": "red_hat_build_of_podman_desktop:rh-podman-desktop.git" }, "product_reference": "rh-podman-desktop.git", "relates_to_product_reference": "red_hat_build_of_podman_desktop" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-42573", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-06-09T18:01:50.543551+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "red_hat_build_of_podman_desktop:rh-podman-desktop.git" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487093" } ], "notes": [ { "category": "description", "text": "A flaw was found in Svelte, a web framework. An attacker could exploit a DOM clobbering vulnerability, which allows manipulation of the Document Object Model (DOM) to overwrite internal framework state on elements. This could potentially lead to Cross-Site Scripting (XSS) attacks, enabling the attacker to inject malicious scripts into web pages viewed by other users.", "title": "Vulnerability description" }, { "category": "summary", "text": "svelte: Svelte: Cross-Site Scripting via DOM Clobbering", "title": "Vulnerability summary" }, { "category": "other", "text": "Severity: Important\n\nThis issue is classified as Important severity for deployments where untrusted content can influence Svelte-rendered markup, because:\n\n- Conditions for Exploitation: The flaw is a DOM clobbering issue in the Svelte framework. Exploitation requires an application to render user-influenced markup using Svelte patterns where attacker-controlled HTML can clobber internal framework state (for example, unsafe spread of form or element attributes in a Svelte component). Remote exploitation requires a victim to interact with attacker-influenced content in the affected application (RH CVSS UI:R).\n\n- Impact Limitations: The vulnerability is in a front-end UI framework dependency, not a standalone network service. Impact is limited to the security context of the application that embeds the vulnerable Svelte runtime.\n\n- Upstream Stance: The upstream Svelte project and GHSA rate this issue Moderate (CVSS 5.3). Red Hat rates it Important with RH CVSS 8.1 where the affected product exposes a network-reachable or user-driven UI that could process untrusted markup through the vulnerable Svelte code paths.\n\nRed Hat build of Podman Desktop 1.0 and 1.1 ship a bundled Svelte dependency, but after engineering review Red Hat Product Security agrees these streams are not affected. Podman Desktop is an Electron-based desktop client, not a public-facing web application. There is no realistic path for an adversary to supply the user-influenced attribute spreads required to trigger DOM clobbering in this product context. The vulnerable Svelte code is not controllable by an adversary in the way the issue describes for typical web deployments.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_not_affected": [ "red_hat_build_of_podman_desktop:rh-podman-desktop.git" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42573" }, { "category": "external", "summary": "RHBZ#2487093", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487093" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42573", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42573" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42573", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42573" }, { "category": "external", "summary": "https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7", "url": "https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7" }, { "category": "external", "summary": "https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42", "url": "https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42" } ], "release_date": "2026-06-09T16:21:29.313000+00:00", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "red_hat_build_of_podman_desktop:rh-podman-desktop.git" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_build_of_podman_desktop:rh-podman-desktop.git" ] } ], "title": "svelte: Svelte: Cross-Site Scripting via DOM Clobbering" } ] }