CVE-2026-42573

Отчет

Severity: Important This issue is classified as Important severity for deployments where untrusted content can influence Svelte-rendered markup, because:

• Conditions for Exploitation: The flaw is a DOM clobbering issue in the Svelte framework. Exploitation requires an application to render user-influenced markup using Svelte patterns where attacker-controlled HTML can clobber internal framework state (for example, unsafe spread of form or element attributes in a Svelte component). Remote exploitation requires a victim to interact with attacker-influenced content in the affected application (RH CVSS UI:R).
• Impact Limitations: The vulnerability is in a front-end UI framework dependency, not a standalone network service. Impact is limited to the security context of the application that embeds the vulnerable Svelte runtime.
• Upstream Stance: The upstream Svelte project and GHSA rate this issue Moderate (CVSS 5.3). Red Hat rates it Important with RH CVSS 8.1 where the affected product exposes a network-reachable or user-driven UI that could process untrusted markup through the vulnerable Svelte code paths. Red Hat build of Podman Desktop 1.0 and 1.1 ship a bundled Svelte dependency, but after engineering review Red Hat Product Security agrees these streams are not affected. Podman Desktop is an Electron-based desktop client, not a public-facing web application. There is no realistic path for an adversary to supply the user-influenced attribute spreads required to trigger DOM clobbering in this product context. The vulnerable Svelte code is not controllable by an adversary in the way the issue describes for typical web deployments.

Меры по смягчению последствий

For Red Hat build of Podman Desktop 1.0 and 1.1, no mitigation or dependency update is required. These streams are not affected; the bundled Svelte runtime is not exposed to adversary-controlled input in a way that enables this DOM clobbering flaw. Other products or components that embed Svelte in a context where untrusted markup can reach vulnerable spread patterns should plan to update the Svelte dependency to version 5.55.7 or later when applicable to their shipping model.