# GHSA-gw32-9rmw-qwww: svelte is vulnerable to XSS with textarea bind:value

## Description
### Summary

A server-side rendered `<textarea>` with two-way bound value does not have its value correctly escaped in the rendered HTML.

### Details

In SSR, `<textarea bind:value={...}>` does not have its value escaped when it is rendered into the HTML as `<textarea>...</textarea>`.

### PoC

Put this in a server-side-rendered Svelte component:

```
<script>
  let value = `test'"></textarea><script` + `>alert('BIM');</sc` + `ript>`;
</script>

<textarea bind:value />
```

### Impact

- Only affects SSR
- Needs a `<textarea bind:value>` filled by user content via two-way binding

## Severity
- **Severity:** HIGH

## Affected Packages
- **svelte** (npm)
  - Vulnerable: >= 3.0.0, < 3.59.2
  - Fixed in: 3.59.2

## References
- https://github.com/sveltejs/svelte/security/advisories/GHSA-gw32-9rmw-qwww
- https://github.com/sveltejs/svelte/commit/a31dec5eb30978cff7ff4d77f4bf316841f711bc
- https://github.com/advisories/GHSA-gw32-9rmw-qwww

## Reproduction Steps

To be determined by the reproduction agent.