From f9e0a3461b9996b7412af76274b3e1d5aa4a5e10 Mon Sep 17 00:00:00 2001
From: onlybugs05 <onlybugs05@gmail.com>
Date: Mon, 4 May 2026 14:18:44 +0530
Subject: [PATCH] fix: address CSS injection bypasses in style directives

---
 packages/svelte/src/internal/shared/attributes.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/svelte/src/internal/shared/attributes.js b/packages/svelte/src/internal/shared/attributes.js
index df42c8a81f..d029d6edbf 100644
--- a/packages/svelte/src/internal/shared/attributes.js
+++ b/packages/svelte/src/internal/shared/attributes.js
@@ -105,6 +105,14 @@ function escape_style_value(value) {
 	for (var i = 0; i < len; i++) {
 		var c = str[i];
 
+		if (c === '\\') {
+			escaped += c;
+			if (i + 1 < len) {
+				escaped += str[++i];
+			}
+			continue;
+		}
+
 		if (in_comment) {
 			if (c === '/' && i > 0 && str[i - 1] === '*') {
 				in_comment = false;
@@ -120,7 +128,7 @@ function escape_style_value(value) {
 		} else if (c === '(') {
 			in_apo++;
 		} else if (c === ')') {
-			in_apo--;
+			if (in_apo > 0) in_apo--;
 		}
 
 		if (c === ';' && !in_comment && in_str === false && in_apo === 0) {